Re: GNU C Library as its own CNA?

[Florian Weimer <fweimer@redhat.com>]

* Siddhesh Poyarekar:

> On 2023-09-06 23:27, Alexandre Oliva wrote:
>> On Sep  6, 2023, Siddhesh Poyarekar <siddhesh@gotplt.org> wrote:
>> 
>>> That would be a worthy goal, but it may be best to have individual
>>> CNAs for glibc, binutils, gcc, etc. because it allows the individual
>>> communities to nominate their own security teams for example and run
>>> independently.
>> I had understood, from the conversations I had when the invitation
>> to
>> join was presented to GNU, that making GNU the CNA, and then having GNU
>> packages under the GNU umbrella, would make things much simpler, and
>> would not stand in the way of nominating separate security teams for
>> specific packages.  So that seemed to make more sense to me.
>
> Maybe they were looking at GNU as a root CNA under Mitre, which
> requires much more compliance and formal organization as I understand
> it.  What I'm proposing is simpler, which is to become a CNA under Red
> Hat as the root CNA under its CVE program[1].  I think it's much
> easier for individual packages to do this as opposed to GNU trying to
> become root CNA directly under Mitre and then setting up individual
> teams/CNAs for packages under it.

GNU is not a legal entity, it would have to be the FSF for the root CNA
agreement.  Delegated CNAs do not need to be legal entities, that's up
to the root CNA to handle according to their policies.

Once the FSF has completed the paperwork, we can consindering the
existing GNU-related CNAs under the FSF root CNA umbrella.  Products and
teams move between organizations all the time, there must be a process
for this already.

A single CNA for GNU wouldn't work because once you are a CNA, it sort
of takes away the ability for any person within the CNA's scope to
interact directly with MITRE.  All communication about disputes, CVE
requests and updates etc. have to go through the CNA instead, so it's a
function that needs to be staffed appropriately.  A component-specific
CNA can just hand out API keys as appropriate, but that's going to be
difficult across the whole of GNU.  If the FSF is a root CNA, it can
management the component-specific CNAs on its own, as far as I
understand the process.

Thanks,
Florian