Re: GNU C Library as its own CNA?

[Alexandre Oliva <oliva@gnu.org>]

On Sep  7, 2023, Siddhesh Poyarekar <siddhesh@gotplt.org> wrote:

> Maybe they were looking at GNU as a root CNA under Mitre

No, the invitation was from Red Hat, same thing you describe.

> I think it's much
> easier for individual packages to do this

It should be just as easy for GNU to do that, and then GNU packages can
enroll even more easily.  That was the picture I got from the
interactions at the time anyway, and it seemed to make sense.

On Sep  7, 2023, Florian Weimer <fweimer@redhat.com> wrote:

> GNU is not a legal entity

Minor point, but it is, it's just not incorporated.  The FSF is its
fiscal sponsor, so if we were talking about root CNA with MITRE, it
would indeed be the FSF that would sign the papers on behalf of GNU, at
GNU's request.

This is quite different from GNU libc, that's not incorporated and is
part of GNU, so ultimately in either case it is GNU and its delegates
who have the autonomy and legitimacy to enter agreements on behalf of
GNU and its parts.  That's why I find it more reasonable to have GNU as
the CNA, and interested GNU packages underneath.

> Products and teams move between organizations all the time, there must
> be a process for this already.

But why make for that trouble if we can help it by doing it right at
first?

> All communication about disputes, CVE
> requests and updates etc. have to go through the CNA instead, so it's a
> function that needs to be staffed appropriately.  A component-specific
> CNA can just hand out API keys as appropriate, but that's going to be
> difficult across the whole of GNU.

There appears to be a boatload of confusing assumptions here.  GNU, as a
larger entity, and with direct FSF support, is far more likely to be
able to staff one or more security teams appropriately than any of its
component packages.  And then, if any single GNU component package is
able to handle that job appropriately, then it follows that GNU can
handle that job appropriately, at least when it comes to that package.
Right?

-- 
Alexandre Oliva, happy hacker                    https://FSFLA.org/blogs/lxo/
   Free Software Activist                           GNU Toolchain Engineer
Disinformation flourishes because many people care deeply about injustice but
very few check the facts.  Think Assange & Stallman.  The empires strike back