unofficial mirror of bug-guix@gnu.org 
 help / color / mirror / code / Atom feed
From: "Mason Hock" <chaosmonk@riseup.net>
To: zimoun <zimon.toutoune@gmail.com>, "Ludovic Courtès" <ludo@gnu.org>
Cc: 43075@debbugs.gnu.org
Subject: bug#43075: Prioritize providing substitutes for security-critical packages with potentially long build times
Date: Thu, 10 Sep 2020 18:06:31 -0700	[thread overview]
Message-ID: <C5K4Y29Y8DMA.12JKZ0JOKGQWE@libricia-thinkcentre> (raw)
In-Reply-To: <CAJ3okZ3_u1TWLRjM_di62W0AfvsNifWpvKyRyaWgh727Qk4HBg@mail.gmail.com>

On Thu Sep 10, 2020 at 2:19 AM PDT, zimoun wrote:
> Hi,
>
> On Thu, 10 Sep 2020 at 10:01, Ludovic Courtès <ludo@gnu.org> wrote:
> > chaosmonk <chaosmonk@riseup.net> skribis:
>
> > > I don't know what Guix's CI system looks like or how packages are
> > > queued for building, but if there is a way to prioritize builds for
> > > certain packages, I propose that substitutes for packages like
> > > ungoogled-chromium should be built as soon as possible once there is a
> > > new version.  Other security-critical packages with potentially long
> > > build times that come to mind are icecat and linux-libre.
>
> > Right now we’re trying to improve build throughput in general but your
> > proposal makes sense, of course.
>
> The recent updates of ungoogled-chromium do not mention [security
> updates].

Security fixes are generally provided upstream by the Chromium devs, so
the place to look for them is not ungoogled-chromium's changelog, but
Chrome/Chromium's changelog.[1]

> Well, I do not know if they are. So the question would be:
> what triggers the special security build?

For ungoogled-chromium, it is safe to assume that every new Chromium
release will contain security fixes.  I'm not sure about a general
solution that would work for other packages.  If Guix is tracking a
package's upstream VCS and upstream has a consistent commit message
format indicating security fixes, perhaps releases containing such
commits could trigger a security build.  Otherwise I'm not sure.

[1] https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop.html

> Well, the work-in-progress [1] about some metrics of Cuirass (Guix's
> CI) would provide interesting answers on the concrete feasibility and
> future improvements.
>
> [1] http://issues.guix.gnu.org/32548#1
>
>
> All the best,
> simon





  parent reply	other threads:[~2020-09-11  1:13 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-08-27 20:50 bug#43075: Prioritize providing substitutes for security-critical packages with potentially long build times chaosmonk
2020-09-10  8:00 ` Ludovic Courtès
2020-09-10  9:19   ` zimoun
2020-09-11  0:47     ` Bengt Richter
2020-09-11  1:06     ` Mason Hock [this message]
2020-09-11  6:56     ` Ludovic Courtès
2020-09-11  7:37       ` zimoun
2020-09-11  8:23         ` Ricardo Wurmus
2020-09-11 13:39         ` Leo Famulari
2020-09-11 14:33         ` Dr. Arne Babenhauserheide
2020-09-11 14:45         ` Ludovic Courtès
2020-09-11  1:14   ` Mason Hock
2020-09-11  6:53     ` Ludovic Courtès

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: https://guix.gnu.org/

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=C5K4Y29Y8DMA.12JKZ0JOKGQWE@libricia-thinkcentre \
    --to=chaosmonk@riseup.net \
    --cc=43075@debbugs.gnu.org \
    --cc=ludo@gnu.org \
    --cc=zimon.toutoune@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).