Re: GNU C Library as its own CNA?

[Siddhesh Poyarekar <siddhesh@gotplt.org>]

On 2023-09-07 13:14, Alexandre Oliva wrote:
> On Sep  7, 2023, Siddhesh Poyarekar <siddhesh@gotplt.org> wrote:
> 
>> Maybe they were looking at GNU as a root CNA under Mitre
> 
> No, the invitation was from Red Hat, same thing you describe.

Then it's not as root, which means it would be a single CNA for all of GNU.

>> I think it's much
>> easier for individual packages to do this
> 
> It should be just as easy for GNU to do that, and then GNU packages can
> enroll even more easily.  That was the picture I got from the
> interactions at the time anyway, and it seemed to make sense.

A single non-root CNA for all of the GNU project doesn't make sense to 
me, given that packages have very distinct communities and needs.  Maybe 
there's a case for some packages to band together because, e.g. they 
have small communities and a single group could handle their security 
needs but for projects like glibc and the other toolchain projects I 
think it makes sense to have separate CNAs.  I don't mind helping other 
GNU maintainers that want to set up their own CNA; for toolchain 
projects other than glibc I'm happy to be directly involved too since I 
actively work on them.

Thanks,
Sid