[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

bug#43075: Prioritize providing substitutes for security-critical packag

From: Mason Hock
Subject: bug#43075: Prioritize providing substitutes for security-critical packages with potentially long build times
Date: Thu, 10 Sep 2020 18:06:31 -0700

On Thu Sep 10, 2020 at 2:19 AM PDT, zimoun wrote:
> Hi,
> On Thu, 10 Sep 2020 at 10:01, Ludovic Courtès <ludo@gnu.org> wrote:
> > chaosmonk <chaosmonk@riseup.net> skribis:
> > > I don't know what Guix's CI system looks like or how packages are
> > > queued for building, but if there is a way to prioritize builds for
> > > certain packages, I propose that substitutes for packages like
> > > ungoogled-chromium should be built as soon as possible once there is a
> > > new version.  Other security-critical packages with potentially long
> > > build times that come to mind are icecat and linux-libre.
> > Right now we’re trying to improve build throughput in general but your
> > proposal makes sense, of course.
> The recent updates of ungoogled-chromium do not mention [security
> updates].

Security fixes are generally provided upstream by the Chromium devs, so
the place to look for them is not ungoogled-chromium's changelog, but
Chrome/Chromium's changelog.[1]

> Well, I do not know if they are. So the question would be:
> what triggers the special security build?

For ungoogled-chromium, it is safe to assume that every new Chromium
release will contain security fixes.  I'm not sure about a general
solution that would work for other packages.  If Guix is tracking a
package's upstream VCS and upstream has a consistent commit message
format indicating security fixes, perhaps releases containing such
commits could trigger a security build.  Otherwise I'm not sure.


> Well, the work-in-progress [1] about some metrics of Cuirass (Guix's
> CI) would provide interesting answers on the concrete feasibility and
> future improvements.
> [1] http://issues.guix.gnu.org/32548#1
> All the best,
> simon

reply via email to

[Prev in Thread] Current Thread [Next in Thread]