Security bugs are reported here via bugzilla

["Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>]

On Sep 20, Seth Alan Woolley [seth AT positivism.org] wrote:
> On Tue, Sep 20, 2005 at 11:47:34PM +0200, Ladislav Hagara wrote:
> > >
> > > So the question is : do you want
> > > some/all of these features in devel, and which ones ?
> > >
> > 
> > There are some problems with security/hardened patches. The big one is 
> > that usually they are not updated immediately with new version of 
> > applications. So you can choose up-to-date version of application or its 
> > stale version with security patch. Of course some users prefer new 
> > version another prefer "secure" version.
> > If we integrate these security features into normal grimoire we will 
> > have to add next VERSIONs into DETAILS of spells. Stable, devel, cvs and 
> > for example selinux version.
> > We need more developers for it. It is easy to add security patch to 
> > apllication once or twice. But  keep them up-to-date and test them with 
> > all options it is a lot of work.
> 
> Agreed for the most part.  We want to keep stuff that doesn't require 
> patches/version separation mainline, and we can keep "hardened" going 
> off to the side until the patches get integrated into the mainline 
> if/when they do.
> 
> Or we can make a spell-hardened spell with the lower version and setup 
> providers if it becomes a small enough grimoire as to not make sense 
> separately.

When spells support full multi-versioning[0] we can make -hardened another
pseudo-version ala "CVS" that uses the last relevant source and the
hardened patches.  We could actually do that now inside our current
multi-version standards[1] (perhaps multi-branch is a better term) pretty
easily.

[0] http://bugs.sourcemage.org/show_bug.cgi?id=8333
[1] http://www.sourcemage.org/grimoire/spell_multi_version

Attachment: pgpIrtiBdSR_4.pgp
Description: PGP signature