Re: GNU C Library as its own CNA?

[Alexandre Oliva <oliva@gnu.org>]

On Sep  6, 2023, Siddhesh Poyarekar <siddhesh@gotplt.org> wrote:

> That would be a worthy goal, but it may be best to have individual
> CNAs for glibc, binutils, gcc, etc. because it allows the individual 
> communities to nominate their own security teams for example and run
> independently.

I had understood, from the conversations I had when the invitation to
join was presented to GNU, that making GNU the CNA, and then having GNU
packages under the GNU umbrella, would make things much simpler, and
would not stand in the way of nominating separate security teams for
specific packages.  So that seemed to make more sense to me.

I'm concerned that starting out with a package, as if it was
independent, would make it harder to bring it into the scope of the GNU
CNA once that was set up, so I'd rather avoid that hassle.

Now, if you're familiar with the requirements and processes, would you
be willing to advise us (GNU leadership and advisory committee) towards
becoming a CNA for GNU packages, with appointed security response teams
for GNU packages that have their own dedicated teams?

Thanks in advance,

-- 
Alexandre Oliva, happy hacker                    https://FSFLA.org/blogs/lxo/
   Free Software Activist                           GNU Toolchain Engineer
Disinformation flourishes because many people care deeply about injustice but
very few check the facts.  Think Assange & Stallman.  The empires strike back