From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by sourceware.org (Postfix) with ESMTPS id 39B083858C50 for ; Tue, 27 Sep 2022 13:03:13 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 39B083858C50 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=redhat.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1664283792; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=/aAZLsADaXO8m7CADQvGsedf849kIw5cidnzmozFk/k=; b=hpdeo5cX8K1MOCW7yQiU9AOIjyfa7tQGkVNgFhveOALV4Ungd6Mlj6LULrDLM1k2vUQ2H2 4nd2tTqeJPr6SFZg8zP5ypjM9Lz3h2dxWslVUbphj1jdogchEnT/8CgFq6YHRRSzPff8EH w3W2JYYSgp8E3o5V/ABPxajZO3RmErc= Received: from mail-io1-f70.google.com (mail-io1-f70.google.com [209.85.166.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_128_GCM_SHA256) id us-mta-356-joRPH7u_NFeZ46d7R8uCRw-1; Tue, 27 Sep 2022 09:03:12 -0400 X-MC-Unique: joRPH7u_NFeZ46d7R8uCRw-1 Received: by mail-io1-f70.google.com with SMTP id 23-20020a5ea517000000b006a496fee582so3785824iog.5 for ; Tue, 27 Sep 2022 06:03:11 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:in-reply-to:organization:from:references :cc:to:content-language:subject:user-agent:mime-version:date :message-id:x-gm-message-state:from:to:cc:subject:date; bh=/aAZLsADaXO8m7CADQvGsedf849kIw5cidnzmozFk/k=; b=FvwKQiH+JcUZsVz6MlL5XDa0CMW3JDm5wE1xYOMyDyPxZTvWwEbunIBbUqtgNTapuM DcFN2HIZjUIiiB50HjkaXifQrUsfzUp+aSOJrn95NTUq41NOTMh9MQHEuZqXlvDTYfMK L+UxSer56/jvMOgFRNxdoOabwf/VDzUiuA/b67BFboOQEewACYGrCbZXtTLMLoVIxucl tXrj/Cgb7acDwjFCPf3Ib/w0zImbOJ3xfNJBHZS85L2t4f/KAwR8CTDW2Oj1mkwNCt/p ZUgi7Sb91fOVfRTPMkT6KEjyQD735s68qgLxVbI3vRQPTi0cKX30CJIhOZCdMrYfXcvR cqlw== X-Gm-Message-State: ACrzQf0Pe9xThEqKkqLNLOR1NBCvu0t2OqpTS13ur3Fsj1Gz56Vt0peD YXq9MbgUjImkUfU8Uqu+XZFzYuIchnS3V4UfJZ7/lsuVt3MQHaBYMKP5+UNBrObqeOc0efgLEpS dp5/R2Nrx+8V8lphVXEd7nOlY35f5h413Zo4qqPjXlF1ICxoRAwzNgU2Z2MsMWjVxttau X-Received: by 2002:a05:6638:258c:b0:35a:7227:3e5c with SMTP id s12-20020a056638258c00b0035a72273e5cmr14373798jat.168.1664283789804; Tue, 27 Sep 2022 06:03:09 -0700 (PDT) X-Google-Smtp-Source: AMsMyM4SYYhdgw+dMZoUnHmSkNaEDtWO4fCn6e3QJ7ZuAXC7pzXKr6N2njn1bDen8BZvsoH5UVd4aA== X-Received: by 2002:a05:6638:258c:b0:35a:7227:3e5c with SMTP id s12-20020a056638258c00b0035a72273e5cmr14373779jat.168.1664283789407; Tue, 27 Sep 2022 06:03:09 -0700 (PDT) Received: from [192.168.0.241] (192-0-145-146.cpe.teksavvy.com. [192.0.145.146]) by smtp.gmail.com with ESMTPSA id u11-20020a056e021a4b00b002f1378de8d5sm613865ilv.40.2022.09.27.06.03.08 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 27 Sep 2022 06:03:08 -0700 (PDT) Message-ID: <444c37f6-1e9e-3af3-0ca8-20a865b0855a@redhat.com> Date: Tue, 27 Sep 2022 09:03:07 -0400 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.11.0 Subject: Re: Moving sourceware to the Linux Foundation? No thanks. To: Overseers mailing list Cc: "Frank Ch. Eigler" References: <87ler4qcmo.fsf@gnu.org> <20220926195716.GD7916@redhat.com> From: Carlos O'Donell Organization: Red Hat In-Reply-To: <20220926195716.GD7916@redhat.com> X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Language: en-US Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=-7.7 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,KAM_EXEURI,NICE_REPLY_A,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_NONE,TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: On 9/26/22 15:57, Frank Ch. Eigler via Overseers wrote: > Hi - > >> I see two important points that ought to be discussed on this topic. > > Thanks for joining the discussion. > >> The first is succession planning. Sourceware is essentially a community >> project with a relatively small number of people keeping it going. It >> needs trusted and capable people to step it to continue to maintain it. >> Where are those people going to come from? We shouldn't simply hope >> that it will keep carrying on as before. > > Fair, we need to attend to recruiting more helpers. (It was with this > in mind that some folks got root on sourceware in the last few years.) > With some moderate funding, the small amount of IT effort this place > requires could be filled out with talented part-timers. OTOH, it's > not an emergency, and the system is not complicated, running > off-the-shelf basic RHEL8 for the core stuff (git, mail, mailing > lists, http, ssh, authentication). I think it's more than just recruiting more helpers. Succession planning means taking Ian's comment seriously, planning out the costs if the volunteers don't show up, and making sure there is funding in place for projected costs. It's a hard problem because tracking down funding is hard, and estimation is also hard. >> The second, mentioned in Mark's e-mail, is security. I hope that we >> can all agree that there are highly intelligent, highly motivated >> people seeking to break security on GNU/Linux and other free >> operating systems. [...] sourceware be defended against these >> kinds of attacks with mechanisms for prevention and detection and >> restoration. [...] > > Luckily, sourceware is a pure upstream source repo, ships no binaries, > and holds no secrets. As long as the integrity of the data is assured > (for example by some mixture of crypto signed git-everything, broad > backups of the git data, and project reviewers/maintainers doing their > jobs), I don't think Thompson's hypothetical attack can be effective. > Certainly, suggestions to improve infrastructure stability / > resilience would be welcome, but it seems like projects can already > self-serve code-repo security, if they choose to. (a) Today - Shipping binary artifacts. Where are the Cygwin windows binaries hosted? For example: https://cygwin.com/setup-x86_64.exe (b) Tomorrow - Shipping binary artifacts. There might be a future where we want to ship cross-tooling directly for the GNU Toolchain to make it easier, like djgpp did, to bring FOSS to an ever expanding and wider audience. Even if we don't ship binaries, shipping source tarballs also might be of interest (currently only shipped via the GNU Project repositories). -- Cheers, Carlos.