From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 8B8C3158020 for ; Thu, 10 Nov 2022 20:55:11 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 0D82BE0A93; Thu, 10 Nov 2022 20:55:08 +0000 (UTC) Received: from smtp.gentoo.org (dev.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id B51EFE0A7D for ; Thu, 10 Nov 2022 20:55:07 +0000 (UTC) Message-ID: <559a9309fcdd0ac2dbadeb30126acfab37ec2166.camel@gentoo.org> Subject: Re: [gentoo-dev] [RFC] A new GLSA schema From: Mart Raudsepp To: gentoo-dev@lists.gentoo.org Date: Thu, 10 Nov 2022 22:55:03 +0200 In-Reply-To: <9f40eb94-8c0b-db72-e004-53bce39f9b88@uls.co.za> References: <39df0838-8dc0-4775-3b66-b7e7d14150dd@uls.co.za> <9f40eb94-8c0b-db72-e004-53bce39f9b88@uls.co.za> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.44.1 Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-dev@lists.gentoo.org Reply-to: gentoo-dev@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply MIME-Version: 1.0 X-Archives-Salt: ce19135e-279b-4d20-9095-7041abb99fa0 X-Archives-Hash: f90187c475cf2eb39b1545f605abb71a =C3=9Chel kenal p=C3=A4eval, N, 10.11.2022 kell 22:07, kirjutas Jaco Kroon: > > Like glsa-check? > We currently use that, but it really just says which GLSAs are=20 > applicable to the system, it doesn't tell me net-misc/asterisk- > 16.0.1:16=20 > - we've got ways of working from the glsa-check output to that.=C2=A0 Of= =20 > particular annoyance if a GLSA lists multiple packages, of which you=20 > have one installed, and one not. Given net-misc/asterisk-16.0.1:16 I > can=20 > quite quickly determine that emerge -1av net-misc/asterisk:16 will=20 > resolve the problem with the lowest possible risk of breakage to > other=20 > components on the system, and without having to perform a full > update. emerge -vpO @security but to get something like it to only showing which installed asterisk SLOT is vulnerable would be some extra coding with portage API I think.