Re: Where should security issues with GNU ELPA packages be reported?

[Philip Kaludercic <philipk@posteo.net>]

Morgan Willcock <morgan@ice9.digital> writes:

> Philip Kaludercic <philipk@posteo.net> writes:
>
>> Morgan Willcock <morgan@ice9.digital> writes:
>>
>>> I think I have found a security issue with a package which is
>>> distributed on GNU ELPA, and I am unsure who to notify.
>>>
>>> Given that the package is technically part of Emacs, do I follow
>>> whatever the procedure would be for disclosing security problems with
>>> Emacs?  If so, what is that procedure?
>>>
>>> Or should I e-mail the package author first?
>>>
>>> Given that it is not the package author who is distributing the package,
>>> I am unsure what to do.
>>
>> It would probably be better to message the maintainer first, if there is
>> no explicit maintainer you can check elpa.git to infer who is
>> responsible.
>
> There is an e-mail address for the maintainer, I just wasn't sure
> whether going to them first was the correct thing to do.

The maintainer of the package can generally push changes to their own
repository and can trigger a new package to be built.  If they do not
respond and it is urgent, anyone with access to elpa.git could push a
commit to the mirror (forking from upstream).

>> Can you disclose what package you are concerned about?
>
> I was not planning on naming it until after I had spoken privately to
> whoever the appropriate person is.  The problem concerns an encryption
> failure which potentially exposes private security keys.

Ok, understandable.

-- 
	Philip Kaludercic on peregrine