Re: Moving sourceware to the Linux Foundation? No thanks.

["Frank Ch. Eigler" <fche@redhat.com>]

Hi -

> I see two important points that ought to be discussed on this topic.

Thanks for joining the discussion.

> The first is succession planning.  Sourceware is essentially a community
> project with a relatively small number of people keeping it going.  It
> needs trusted and capable people to step it to continue to maintain it.
> Where are those people going to come from?  We shouldn't simply hope
> that it will keep carrying on as before.

Fair, we need to attend to recruiting more helpers.  (It was with this
in mind that some folks got root on sourceware in the last few years.)
With some moderate funding, the small amount of IT effort this place
requires could be filled out with talented part-timers.  OTOH, it's
not an emergency, and the system is not complicated, running
off-the-shelf basic RHEL8 for the core stuff (git, mail, mailing
lists, http, ssh, authentication).


> The second, mentioned in Mark's e-mail, is security.  I hope that we
> can all agree that there are highly intelligent, highly motivated
> people seeking to break security on GNU/Linux and other free
> operating systems.  [...]  sourceware be defended against these
> kinds of attacks with mechanisms for prevention and detection and
> restoration.  [...]

Luckily, sourceware is a pure upstream source repo, ships no binaries,
and holds no secrets.  As long as the integrity of the data is assured
(for example by some mixture of crypto signed git-everything, broad
backups of the git data, and project reviewers/maintainers doing their
jobs), I don't think Thompson's hypothetical attack can be effective.
Certainly, suggestions to improve infrastructure stability /
resilience would be welcome, but it seems like projects can already
self-serve code-repo security, if they choose to.


- FChE