Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 17 Oct 2023 08:00:36 +0200
From: Morten Linderud <>
Subject: Re: linux-distros list membership application - CIQ
 Rocky Linux Security Team

On Fri, Oct 13, 2023 at 11:19:18PM -0400, Neal Gompa wrote:
> On Fri, Oct 13, 2023 at 8:07 PM Martin Hecht <> wrote:
> > Well, assuming there was a security team in these projects able to obey
> > the embargo regulations, wouldn't they have tried to join?
> > But, nevertheless, what is the relation of the organizational structure
> > of these projects with the current application of CIQ/Rocky, after all?
> >
> The point I'm making is that SIGs do not count because they cannot
> obey embargo regulations. No open project or community project can do
> that without having some mechanism for private controls, which is
> antithetical to the community process. They fundamentally are
> ineligible to join because they cannot keep anything secret.

This just seems like a personal opinion projected onto the relevant projects
though. There is nothing preventing you from getting access to patches and
distributing them to relevant package maintainers for preperation under an

Evidently there are three atleast 3 community distros already participating on
the linux-distros list, namely Debian, Arch and Gentoo. So while Fedora might
not have any way to distribute patches, please don't infer that this applies to
all community distros.

We do this in Arch Linux, and I've personally handeled several embargos as a
community project.

A relevant piece of information is also the well-written Gentoo Pre-Release
Disclosure Agreement they have with their package maintainers.

Personally my impression of Fedora after trying to pay attention to their
security meetings and general security planning, all of this seems to be
handeled by Red Hat. So Fedora might not have any need to join the Linux distros
list themselves.

Morten Linderud

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.