Re: GNU C Library as its own CNA?

[Siddhesh Poyarekar <siddhesh@gotplt.org>]

On 2023-09-06 23:27, Alexandre Oliva wrote:
> On Sep  6, 2023, Siddhesh Poyarekar <siddhesh@gotplt.org> wrote:
> 
>> That would be a worthy goal, but it may be best to have individual
>> CNAs for glibc, binutils, gcc, etc. because it allows the individual
>> communities to nominate their own security teams for example and run
>> independently.
> 
> I had understood, from the conversations I had when the invitation to
> join was presented to GNU, that making GNU the CNA, and then having GNU
> packages under the GNU umbrella, would make things much simpler, and
> would not stand in the way of nominating separate security teams for
> specific packages.  So that seemed to make more sense to me.

Maybe they were looking at GNU as a root CNA under Mitre, which requires 
much more compliance and formal organization as I understand it.  What 
I'm proposing is simpler, which is to become a CNA under Red Hat as the 
root CNA under its CVE program[1].  I think it's much easier for 
individual packages to do this as opposed to GNU trying to become root 
CNA directly under Mitre and then setting up individual teams/CNAs for 
packages under it.

> I'm concerned that starting out with a package, as if it was
> independent, would make it harder to bring it into the scope of the GNU
> CNA once that was set up, so I'd rather avoid that hassle.
> 
> Now, if you're familiar with the requirements and processes, would you
> be willing to advise us (GNU leadership and advisory committee) towards
> becoming a CNA for GNU packages, with appointed security response teams
> for GNU packages that have their own dedicated teams?

I still don't think a single CNA for all of GNU is a good idea because 
packages under GNU have very different processes and security 
requirements.  Maybe GNU as a root CNA (and then projects as subordinate 
CNAs) is something you may be interested in but I'm of limited use 
there.  Given the looseness of the setup for the subordinate CNAs, I 
don't think it should be too hard to move root CNAs later on if that is 
of interest to the community.

Thanks,
Sid

[1] https://access.redhat.com/articles/red_hat_cve_program