Re: [gentoo-project] Re: [gentoo-dev-announce] Call for agenda items - Council meeting 2018-12-09

[Kristian Fiskerstrand <k_f@gentoo.org>]

On 12/4/18 4:41 AM, Michał Górny wrote:
> Are you asking the Council to make a policy for security team,
> or to override the existing policy of security team?  Because this
> sounds like you're implying that security team can't make up their mind.

This is indeed part of the ongoing discussion surrounding the GLEP for
the security team; Before anything should go to council on this we need
to put the the current draft up for a public discussion on the -project
mailing list.

> 
> Also, if the Council votes 'yes', what happens next?  Does security
> accept all stable arches?  Do stable arches get demoted implicitly based
> on security project considerations?

The assumption would be that security needs to have a say for whenever
an arch is added or if requesting to remove an arch. To balance this a a
GLEP48-style/QA-style lead approval process is added and criteria to be
used for such determination is included.

Personally I don't see a problem with the status quo where security
supported arches is listed as part of security project's documentation,
and removals announced etc. The actual security implication for a lot of
these arches will anyways be impacted by members of the team having
limited knowledge of particulars, in particular when it come to auditing
due to difference in assembly etc, so the major arches will anyways have
a better foundation for being handled by the team, so security is
relative to what we claim to know and do.

In any case, too early for the council to do anything here.

-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3