[Secure-testing-team] what else needs a DTSA right now?

[Moritz Muehlenhoff]

Joey Hess wrote:
> > > Can anyone suggest any more good candidates for DTSAs in the list of
> > > unfixed holes in testing? I've been trying to cover all the remote
> > > exploits and bad local exploits and aside from updating the kernel and
> > 
> > I want to have a deeper look at this. Horms has some stuff pending
> > he hasn't had the time to backport yet and some CVE assignments are
> > pending, but preparing updated recent 2.6.8 and 2.4.27 packages
> > for etch seems like a good idea (as they are security/major fix only
> > anyway), until linux-2.6 has made it into testing.
> 
> The big problem with this is that it cannot be autobuilt since etch
> still has all the different kernel source packages.

Yes, but plenty of porters in debian-kernel were building the kernels
Horms prepared for Sarge, so they might be willing to do the same for
Etch as well.
 
> One nice opportunity we have though, is to let developers do uploads and
> testing, so I do encourage that.

We should create a boilerplate text for direct inclusion in bug reports,
so this won't be missed.
 
> > BTW2, in cases where the maintainer has uploaded fixed packages,
> > we should add them to the DTSA: to prevent ill-feelings/mischief and
> > also as a direct indicator who's to blame if something goes wrong ;-)
> 
> Heh, sure, any idea where to list them?

No concrete idea, above the "Upgrade Instructions", maybe?
 
> > >  - zlib: too young in unstable, would rather not add new upstreams of
> > >    core libs to the repo until we know what can go wrong
> > 
> > The DSAs contain patches against 1.2.2, so they'd be good alternatives.
> > 
> > OTOH, I can't remember any major code changes, when I reviewed the changes
> > while preparing the fix for UCS; it was mostly portability fixes and
> > changes for contrib compression algos.
> 
> Would you like to do a DTSA for it?

Generally, yes. But I have to prepare some work for my thesis colloquium on
Thursday, so if anyone has free time before that, go ahead.

Cheers,
        Moritz