Better handling of NEW packages (yes, sec related)
Hi,
Yesterday I went through the list of NFUs and reviewed some of those that I
recognised as being in the archive. Although this process could be more or
less automated by using the information by the NVD (in a similar way its
use was mentioned on the other thread), there's also a gap between the data
on the tracker and newly introduced packages.
My proposal is to write a script that gathers the list of accepted NEW
source packages and adds them to a file (probably
data/packages/new-packages) so that they can be reviewed (as in marking
NFUs as affecting the package, quickly looking for embedded code copies,
etc).
That should reduce the chances of us not being aware of a newly introduced
package with open security holes.
What do you think?
I know it's a bit more work, but it's another step towards security
assurance.
Cheers,
--
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net
Reply to: