en/glep/glep-0014.html

<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<head>
  <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
  <meta name="generator" content="Docutils 0.4: http://docutils.sourceforge.net/" />
  <title>GLEP 14 -- security updates based on GLSA</title>
  <link rel="stylesheet" href="tools/glep.css" type="text/css" />
</head>
<body bgcolor="white">
<table class="navigation" cellpadding="0" cellspacing="0"
       width="100%" border="0">
<tr><td class="navicon" width="150" height="35">
<a href="http://www.gentoo.org/" title="Gentoo Linux Home Page">
<img src="http://www.gentoo.org/images/gentoo-new.gif" alt="[Gentoo]"
 border="0" width="150" height="35" /></a></td>
<td class="textlinks" align="left">
[<b><a href="http://www.gentoo.org/">Gentoo Linux Home</a></b>]
[<b><a href="http://www.gentoo.org/proj/en/glep">GLEP Index</a></b>]
[<b><a href="http://www.gentoo.org/proj/en/glep/glep-0014.txt">GLEP Source</a></b>]
</td></tr></table>
<table class="rfc2822 docutils field-list" frame="void" rules="none">
<col class="field-name" />
<col class="field-body" />
<tbody valign="top">
<tr class="field"><th class="field-name">GLEP:</th><td class="field-body">14</td>
</tr>
<tr class="field"><th class="field-name">Title:</th><td class="field-body">security updates based on GLSA</td>
</tr>
<tr class="field"><th class="field-name">Version:</th><td class="field-body">1.6</td>
</tr>
<tr class="field"><th class="field-name">Last-Modified:</th><td class="field-body"><a class="reference" href="http://www.gentoo.org/cgi-bin/viewcvs.cgi/xml/htdocs/proj/en/glep/glep-0014.txt?cvsroot=gentoo">2006/10/14 02:54:24</a></td>
</tr>
<tr class="field"><th class="field-name">Author:</th><td class="field-body">Marius Mauch &lt;genone&#32;&#97;t&#32;genone.de&gt;,</td>
</tr>
<tr class="field"><th class="field-name">Status:</th><td class="field-body">Accepted</td>
</tr>
<tr class="field"><th class="field-name">Type:</th><td class="field-body">Standards Track</td>
</tr>
<tr class="field"><th class="field-name">Content-Type:</th><td class="field-body"><a class="reference" href="glep-0002.html">text/x-rst</a></td>
</tr>
<tr class="field"><th class="field-name">Created:</th><td class="field-body">18 Aug 2003</td>
</tr>
<tr class="field"><th class="field-name">Post-History:</th><td class="field-body">22-Aug-2003, 24-Aug-2003, 10-Nov-2003, 25-Oct-2004</td>
</tr>
<tr class="field"><th class="field-name">Requires:</th><td class="field-body"><a class="reference" href="http://www.gentoo.org/proj/en/glepglep-0021.html">21</a></td>
</tr>
</tbody>
</table>
<hr />
<div class="contents topic">
<p class="topic-title first"><a id="contents" name="contents">Contents</a></p>
<ul class="simple">
<li><a class="reference" href="#abstract" id="id2" name="id2">Abstract</a></li>
<li><a class="reference" href="#status-update" id="id3" name="id3">Status Update</a></li>
<li><a class="reference" href="#motivation" id="id4" name="id4">Motivation</a></li>
<li><a class="reference" href="#proposed-change" id="id5" name="id5">Proposed change</a><ul>
<li><a class="reference" href="#update-tool" id="id6" name="id6">Update tool</a></li>
<li><a class="reference" href="#glsa-format" id="id7" name="id7">GLSA format</a></li>
<li><a class="reference" href="#glsa-release-process" id="id8" name="id8">GLSA release process</a></li>
<li><a class="reference" href="#portage-changes" id="id9" name="id9">Portage changes</a></li>
</ul>
</li>
<li><a class="reference" href="#rationale" id="id10" name="id10">Rationale</a></li>
<li><a class="reference" href="#implementation" id="id11" name="id11">Implementation</a></li>
<li><a class="reference" href="#backwards-compatibility" id="id12" name="id12">Backwards compatibility</a></li>
<li><a class="reference" href="#copyright" id="id13" name="id13">Copyright</a></li>
</ul>
</div>
<div class="section">
<h1><a class="toc-backref" href="#id2" id="abstract" name="abstract">Abstract</a></h1>
<p>There is currently no automatic way to check a Gentoo system for identified
security holes or auto-apply security fixes. This GLEP proposes a way to deal
with this issue</p>
</div>
<div class="section">
<h1><a class="toc-backref" href="#id3" id="status-update" name="status-update">Status Update</a></h1>
<p>Preliminary implementation <tt class="docutils literal"><span class="pre">glsa-check</span></tt> in gentoolkit, final implementation
pending set support in portage (GLEP 21).</p>
</div>
<div class="section">
<h1><a class="toc-backref" href="#id4" id="motivation" name="motivation">Motivation</a></h1>
<p>Automatic checking for security updates is a often requested feature for Gentoo.
Implementing it will enable users to fix security holes without reading every
security announcement. It's also a feature that is often required in enterprise
environments.</p>
</div>
<div class="section">
<h1><a class="toc-backref" href="#id5" id="proposed-change" name="proposed-change">Proposed change</a></h1>
<div class="section">
<h2><a class="toc-backref" href="#id6" id="update-tool" name="update-tool">Update tool</a></h2>
<p>The coding part of this GLEP is a update tool that reads a GLSA, verifies its
GPG signature, checks if the system is affected by it and executes one of the
following actions, depending on user preferences:</p>
<ul class="simple">
<li>run all steps necessary to fix the security hole, including package updates and
daemon restarts.</li>
<li>instruct the user how to fix the security hole.</li>
<li>print the GLSA so the user can get more information if desired.</li>
</ul>
<p>Once this tool is implemented and well tested it can be integrated into portage.
A prototype <a class="reference" href="#implementation">implementation</a> for this tool exists.</p>
</div>
<div class="section">
<h2><a class="toc-backref" href="#id7" id="glsa-format" name="glsa-format">GLSA format</a></h2>
<p>The GLSA format needs to be specified, I suggest using XML for that to simplify
parsing and later extensions. See <a class="reference" href="#implementation">implementation</a> for a sample DTD. The format
has to be compatible with the update tool of course. If necessary a converter
tool or an editor could be written for people not comfortable with XML (update:
a QT based editor for the GLSA format written by plasmaroo exists in the
gentoo-projects repository). Every GLSA has to be GPG signed by the responsible
developer, who has to be a member of the security herd.</p>
</div>
<div class="section">
<h2><a class="toc-backref" href="#id8" id="glsa-release-process" name="glsa-release-process">GLSA release process</a></h2>
<p>Additional to sending the GLSA to the gentoo-announce mailing list it has to be
stored on a HTTP/FTP server and in the portage tree. I'd suggest a script should
be used to release a GLSA that will:</p>
<ul class="simple">
<li>check the GLSA for correctness</li>
<li>sign the GLSA with the developers GPG key</li>
<li>send a mail to gentoo-announce with the XML GLSA and a plaintext version attached</li>
<li>upload it to www.gentoo.org/security/en/glsa (via cvs commit)</li>
<li>put it on the rsync server (via cvs commit)</li>
<li>notify the moderators on the forums to make an announcement</li>
</ul>
</div>
<div class="section">
<h2><a class="toc-backref" href="#id9" id="portage-changes" name="portage-changes">Portage changes</a></h2>
<p>Until the <a class="reference" href="#update-tool">update tool</a> is integrated into portage there will be no code changes
to portage. The update tool might require a few new configuration options, these
could be placed in make.conf or another config file in /etc/portage.</p>
</div>
</div>
<div class="section">
<h1><a class="toc-backref" href="#id10" id="rationale" name="rationale">Rationale</a></h1>
<p>The lack of automated security updates for Gentoo is one of the most often requested
features for portage as it is one of the standard features of other distributions.
As Gentoo already provides GLSAs for important security bugs it is only natural
to use these to implement this feature.</p>
<p>To parse a GLSA in a program the format needs to be specified and a parser has
to be written. I suggest the use of XML for future GLSAs for the following reasons:</p>
<ul class="simple">
<li>can be parsed and validated with existing libraries</li>
<li>easy to extend while maintaining backwards compatibility</li>
<li>tools can convert XML GLSAs in other formats, the other direction would be harder</li>
<li>websites can use XSLT to markup GLSAs</li>
</ul>
<p>Putting the GLSAs in the portage tree allows all users to check their systems
for security updates without taking more actions and simplifies later integration
of the update tool into portage. For security minded persons the GLSAs are
available on a HTTP server to ease the load of the rsync servers.</p>
<p>To verify the signatures of the GLSAs the public keys of the developers should be
available in the portage tree and on the HTTP server. The verification is necessary
to prevent exploits by fake GLSAs.</p>
</div>
<div class="section">
<h1><a class="toc-backref" href="#id11" id="implementation" name="implementation">Implementation</a></h1>
<p>A prototype implementation (including the update tool, a DTD and a sample
XMLified GLSA) exists at <a class="reference" href="http://gentoo.devel-net.org/glsa/">http://gentoo.devel-net.org/glsa/</a> and in the
gentoo-projects/gentoo-security/GLSA repository. This GLEP is based
on that implementation, though it can be changed or rewritten if necessary.</p>
</div>
<div class="section">
<h1><a class="toc-backref" href="#id12" id="backwards-compatibility" name="backwards-compatibility">Backwards compatibility</a></h1>
<p>The current <a class="reference" href="#glsa-release-process">GLSA release process</a> needs to be replaced with this proposal. It
would be nice if old GLSAs would be transformed into XML as well, but that is
not a requirement for this GLEP.</p>
</div>
<div class="section">
<h1><a class="toc-backref" href="#id13" id="copyright" name="copyright">Copyright</a></h1>
<p>This document has been placed in the public domain.</p>
</div>

</div>
<div class="footer">
<hr class="footer" />
<a class="reference" href="glep-0014.txt">View document source</a>.
Generated on: 2007-10-13 13:39 UTC.
Generated by <a class="reference" href="http://docutils.sourceforge.net/">Docutils</a> from <a class="reference" href="http://docutils.sourceforge.net/rst.html">reStructuredText</a> source.

</div>
</body>
</html>

1	<?xml version="1.0" encoding="utf-8" ?>
2	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3	<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
4
5	<head>
6	<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
7	<meta name="generator" content="Docutils 0.4: http://docutils.sourceforge.net/" />
8	<title>GLEP 14 -- security updates based on GLSA</title>
9	<link rel="stylesheet" href="tools/glep.css" type="text/css" />
10	</head>
11	<body bgcolor="white">
12	<table class="navigation" cellpadding="0" cellspacing="0"
13	width="100%" border="0">
14	<tr><td class="navicon" width="150" height="35">
15	<a href="http://www.gentoo.org/" title="Gentoo Linux Home Page">
16	<img src="http://www.gentoo.org/images/gentoo-new.gif" alt="[Gentoo]"
17	border="0" width="150" height="35" /></a></td>
18	<td class="textlinks" align="left">
19	[<b><a href="http://www.gentoo.org/">Gentoo Linux Home</a></b>]
20	[<b><a href="http://www.gentoo.org/proj/en/glep">GLEP Index</a></b>]
21	[<b><a href="http://www.gentoo.org/proj/en/glep/glep-0014.txt">GLEP Source</a></b>]
22	</td></tr></table>
23	<table class="rfc2822 docutils field-list" frame="void" rules="none">
24	<col class="field-name" />
25	<col class="field-body" />
26	<tbody valign="top">
27	<tr class="field"><th class="field-name">GLEP:</th><td class="field-body">14</td>
28	</tr>
29	<tr class="field"><th class="field-name">Title:</th><td class="field-body">security updates based on GLSA</td>
30	</tr>
31	<tr class="field"><th class="field-name">Version:</th><td class="field-body">1.6</td>
32	</tr>
33	<tr class="field"><th class="field-name">Last-Modified:</th><td class="field-body"><a class="reference" href="http://www.gentoo.org/cgi-bin/viewcvs.cgi/xml/htdocs/proj/en/glep/glep-0014.txt?cvsroot=gentoo">2006/10/14 02:54:24</a></td>
34	</tr>
35	<tr class="field"><th class="field-name">Author:</th><td class="field-body">Marius Mauch <genone at genone.de>,</td>
36	</tr>
37	<tr class="field"><th class="field-name">Status:</th><td class="field-body">Accepted</td>
38	</tr>
39	<tr class="field"><th class="field-name">Type:</th><td class="field-body">Standards Track</td>
40	</tr>
41	<tr class="field"><th class="field-name">Content-Type:</th><td class="field-body"><a class="reference" href="glep-0002.html">text/x-rst</a></td>
42	</tr>
43	<tr class="field"><th class="field-name">Created:</th><td class="field-body">18 Aug 2003</td>
44	</tr>
45	<tr class="field"><th class="field-name">Post-History:</th><td class="field-body">22-Aug-2003, 24-Aug-2003, 10-Nov-2003, 25-Oct-2004</td>
46	</tr>
47	<tr class="field"><th class="field-name">Requires:</th><td class="field-body"><a class="reference" href="http://www.gentoo.org/proj/en/glepglep-0021.html">21</a></td>
48	</tr>
49	</tbody>
50	</table>
51	<hr />
52	<div class="contents topic">
53	<p class="topic-title first"><a id="contents" name="contents">Contents</a></p>
54	<ul class="simple">
55	<li><a class="reference" href="#abstract" id="id2" name="id2">Abstract</a></li>
56	<li><a class="reference" href="#status-update" id="id3" name="id3">Status Update</a></li>
57	<li><a class="reference" href="#motivation" id="id4" name="id4">Motivation</a></li>
58	<li><a class="reference" href="#proposed-change" id="id5" name="id5">Proposed change</a><ul>
59	<li><a class="reference" href="#update-tool" id="id6" name="id6">Update tool</a></li>
60	<li><a class="reference" href="#glsa-format" id="id7" name="id7">GLSA format</a></li>
61	<li><a class="reference" href="#glsa-release-process" id="id8" name="id8">GLSA release process</a></li>
62	<li><a class="reference" href="#portage-changes" id="id9" name="id9">Portage changes</a></li>
63	</ul>
64	</li>
65	<li><a class="reference" href="#rationale" id="id10" name="id10">Rationale</a></li>
66	<li><a class="reference" href="#implementation" id="id11" name="id11">Implementation</a></li>
67	<li><a class="reference" href="#backwards-compatibility" id="id12" name="id12">Backwards compatibility</a></li>
68	<li><a class="reference" href="#copyright" id="id13" name="id13">Copyright</a></li>
69	</ul>
70	</div>
71	<div class="section">
72	<h1><a class="toc-backref" href="#id2" id="abstract" name="abstract">Abstract</a></h1>
73	<p>There is currently no automatic way to check a Gentoo system for identified
74	security holes or auto-apply security fixes. This GLEP proposes a way to deal
75	with this issue</p>
76	</div>
77	<div class="section">
78	<h1><a class="toc-backref" href="#id3" id="status-update" name="status-update">Status Update</a></h1>
79	<p>Preliminary implementation <tt class="docutils literal"><span class="pre">glsa-check</span></tt> in gentoolkit, final implementation
80	pending set support in portage (GLEP 21).</p>
81	</div>
82	<div class="section">
83	<h1><a class="toc-backref" href="#id4" id="motivation" name="motivation">Motivation</a></h1>
84	<p>Automatic checking for security updates is a often requested feature for Gentoo.
85	Implementing it will enable users to fix security holes without reading every
86	security announcement. It's also a feature that is often required in enterprise
87	environments.</p>
88	</div>
89	<div class="section">
90	<h1><a class="toc-backref" href="#id5" id="proposed-change" name="proposed-change">Proposed change</a></h1>
91	<div class="section">
92	<h2><a class="toc-backref" href="#id6" id="update-tool" name="update-tool">Update tool</a></h2>
93	<p>The coding part of this GLEP is a update tool that reads a GLSA, verifies its
94	GPG signature, checks if the system is affected by it and executes one of the
95	following actions, depending on user preferences:</p>
96	<ul class="simple">
97	<li>run all steps necessary to fix the security hole, including package updates and
98	daemon restarts.</li>
99	<li>instruct the user how to fix the security hole.</li>
100	<li>print the GLSA so the user can get more information if desired.</li>
101	</ul>
102	<p>Once this tool is implemented and well tested it can be integrated into portage.
103	A prototype <a class="reference" href="#implementation">implementation</a> for this tool exists.</p>
104	</div>
105	<div class="section">
106	<h2><a class="toc-backref" href="#id7" id="glsa-format" name="glsa-format">GLSA format</a></h2>
107	<p>The GLSA format needs to be specified, I suggest using XML for that to simplify
108	parsing and later extensions. See <a class="reference" href="#implementation">implementation</a> for a sample DTD. The format
109	has to be compatible with the update tool of course. If necessary a converter
110	tool or an editor could be written for people not comfortable with XML (update:
111	a QT based editor for the GLSA format written by plasmaroo exists in the
112	gentoo-projects repository). Every GLSA has to be GPG signed by the responsible
113	developer, who has to be a member of the security herd.</p>
114	</div>
115	<div class="section">
116	<h2><a class="toc-backref" href="#id8" id="glsa-release-process" name="glsa-release-process">GLSA release process</a></h2>
117	<p>Additional to sending the GLSA to the gentoo-announce mailing list it has to be
118	stored on a HTTP/FTP server and in the portage tree. I'd suggest a script should
119	be used to release a GLSA that will:</p>
120	<ul class="simple">
121	<li>check the GLSA for correctness</li>
122	<li>sign the GLSA with the developers GPG key</li>
123	<li>send a mail to gentoo-announce with the XML GLSA and a plaintext version attached</li>
124	<li>upload it to www.gentoo.org/security/en/glsa (via cvs commit)</li>
125	<li>put it on the rsync server (via cvs commit)</li>
126	<li>notify the moderators on the forums to make an announcement</li>
127	</ul>
128	</div>
129	<div class="section">
130	<h2><a class="toc-backref" href="#id9" id="portage-changes" name="portage-changes">Portage changes</a></h2>
131	<p>Until the <a class="reference" href="#update-tool">update tool</a> is integrated into portage there will be no code changes
132	to portage. The update tool might require a few new configuration options, these
133	could be placed in make.conf or another config file in /etc/portage.</p>
134	</div>
135	</div>
136	<div class="section">
137	<h1><a class="toc-backref" href="#id10" id="rationale" name="rationale">Rationale</a></h1>
138	<p>The lack of automated security updates for Gentoo is one of the most often requested
139	features for portage as it is one of the standard features of other distributions.
140	As Gentoo already provides GLSAs for important security bugs it is only natural
141	to use these to implement this feature.</p>
142	<p>To parse a GLSA in a program the format needs to be specified and a parser has
143	to be written. I suggest the use of XML for future GLSAs for the following reasons:</p>
144	<ul class="simple">
145	<li>can be parsed and validated with existing libraries</li>
146	<li>easy to extend while maintaining backwards compatibility</li>
147	<li>tools can convert XML GLSAs in other formats, the other direction would be harder</li>
148	<li>websites can use XSLT to markup GLSAs</li>
149	</ul>
150	<p>Putting the GLSAs in the portage tree allows all users to check their systems
151	for security updates without taking more actions and simplifies later integration
152	of the update tool into portage. For security minded persons the GLSAs are
153	available on a HTTP server to ease the load of the rsync servers.</p>
154	<p>To verify the signatures of the GLSAs the public keys of the developers should be
155	available in the portage tree and on the HTTP server. The verification is necessary
156	to prevent exploits by fake GLSAs.</p>
157	</div>
158	<div class="section">
159	<h1><a class="toc-backref" href="#id11" id="implementation" name="implementation">Implementation</a></h1>
160	<p>A prototype implementation (including the update tool, a DTD and a sample
161	XMLified GLSA) exists at <a class="reference" href="http://gentoo.devel-net.org/glsa/">http://gentoo.devel-net.org/glsa/</a> and in the
162	gentoo-projects/gentoo-security/GLSA repository. This GLEP is based
163	on that implementation, though it can be changed or rewritten if necessary.</p>
164	</div>
165	<div class="section">
166	<h1><a class="toc-backref" href="#id12" id="backwards-compatibility" name="backwards-compatibility">Backwards compatibility</a></h1>
167	<p>The current <a class="reference" href="#glsa-release-process">GLSA release process</a> needs to be replaced with this proposal. It
168	would be nice if old GLSAs would be transformed into XML as well, but that is
169	not a requirement for this GLEP.</p>
170	</div>
171	<div class="section">
172	<h1><a class="toc-backref" href="#id13" id="copyright" name="copyright">Copyright</a></h1>
173	<p>This document has been placed in the public domain.</p>
174	</div>
175
176	</div>
177	<div class="footer">
178	<hr class="footer" />
179	<a class="reference" href="glep-0014.txt">View document source</a>.
180	Generated on: 2007-10-13 13:39 UTC.
181	Generated by <a class="reference" href="http://docutils.sourceforge.net/">Docutils</a> from <a class="reference" href="http://docutils.sourceforge.net/rst.html">reStructuredText</a> source.
182
183	</div>
184	</body>
185	</html>
186