Re: [gentoo-dev] GLEP #14: security updates based on GLSA

[Marius Mauch <genone@genone.de>]

On Fri, 22 Aug 2003 19:45:46 +0100
James Harlow <james@is.never.wrong.nu> wrote:

> It would be nice if the solution and the command became mandatory, and
> the command was formatted so that it could be run with /bin/sh.

I don't like that for several reasons:
- it's not necessary if a simple package upgrade can solve the issue
- there are general concerns about the inclusion of the <command> tag

> It's also my feeling that the exploit element should become an
> attribute so it can be checked - for example, if I'm writing a tool to
> secure a firewall while I'm on holiday, it would be essential to
> update remote holes, but less essential to update local holes.

I don't understand this, why would an attribute be better than an
element? I might *add* an attribute to the exploit tag if we can define
the possible values for that.

> And lastly and cosmetically, dates are normally represented as a 
> day/month/year structure. In the version element, I think that you 
> should get rid of the including attribute and extend the range
> attribute with greater-or-equal / less-than-or-equal. It's just my
> feeling that this will create more readable xml documents...

As said by Paul and Chris, the YYYYMMDD format is better suited and I'll
change the tool and the example to use it. For the version format, I'll
put that in the queue as there might be more changes necessary (see
Pauls request for a between tag).

Marius

--
gentoo-dev@gentoo.org mailing list