From mboxrd@z Thu Jan 1 00:00:00 1970 From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: Re: Security updates for bundled copies of libraries in Qt Date: Tue, 18 Aug 2015 16:59:13 +0200 Message-ID: <87fv3gskvy.fsf@gnu.org> References: <20150726095545.GA29093@debian> <20150726110200.GA7976@debian> <87egjvexuy.fsf@gmail.com> <20150727083128.GA5271@debian> <87h9op7m2u.fsf@gmail.com> <20150802093741.GA4366@debian> <87h9ohmr31.fsf_-_@netris.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:54184) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZRiMB-0003Tb-NH for guix-devel@gnu.org; Tue, 18 Aug 2015 10:59:25 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZRiM8-0001zW-Se for guix-devel@gnu.org; Tue, 18 Aug 2015 10:59:19 -0400 In-Reply-To: <87h9ohmr31.fsf_-_@netris.org> (Mark H. Weaver's message of "Sun, 02 Aug 2015 15:24:18 -0400") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org To: Mark H Weaver Cc: guix-devel@gnu.org Mark H Weaver skribis: > Fair enough, but consider this: IMO, the most severe problem with using > bundled copies of libraries has to do with security updates. We have > yet to develop a security policy, but in my opinion we should not allow > software with known security flaws to remain in Guix for more than a > short time. Either someone must take responsibility for applying > security fixes to a given package, or else that package should be > removed. Does that make sense? I think it is clear that we must avoid bundled libraries, and it seems there=E2=80=99s consensus on this. Would someone like to prepare a subsect= ion on this under =E2=80=9CPackaging Guidelines=E2=80=9D? As for the policy of removing packages that lack security updates, I=E2=80= =99d be all for it in an ideal world. However, I wonder if we can afford to follow an all-or-nothing policy this strictly at this point. To palliate our limited development resources, what we do need is tools (perhaps an extension to =E2=80=98guix refresh=E2=80=99 or =E2=80=98guix li= nt=E2=80=99) to at least determine whether there are unpatched CVEs in our packages. I know this is possible because the Nixpkgs Monitor has something like that: . I=E2=80=99ve just opened a bug for it. Any takers? > I've been doing my best to apply security fixes to Guix in a timely > fashion -- which turns out to be a big job and I could use more help -- > but I'm *not* willing to do the duplicated work of applying the same > fixes to the bundled copies of libraries in Qt. If our Qt packages are > going to use bundled copies of libraries, then someone needs to take > responsibility for applying security updates to those copies. In there was consensus that, to begin with, we should remove the bundled Chromium and all the things it pulls from Qt5, and =E5=AE=8B=E6=96=87=E6=AD= =A6 half-volunteered ;-) to work on the modular Qt5. I=E2=80=99ve open a bug to keep track of this (bugs.gnu.org seems to be currently unreachable, though.) Ludo=E2=80=99.