Bugzilla – Bug 1223086
consider integrity checking in source services mandatory
Last modified: 2024-05-15 12:08:44 UTC
Not sure if this is the right component/product... I have previously asked this similarly via mail, so trying here to not let it drop off the table again: Can we agree to consider the following as security bugs?: In scope: Any source services available in Factory, when no explicit argument like "insecure" is enabled (so a program can find and count them, an exhaustive list of those exception labels will be later defined in source_validator). If a bug is found that makes the output not reproducible or verification of downloads is not cryptographically secure, it is categorised as a security bug to be fixed. Out of scope, for now: How those services are used in packages. For larger context see: https://github.com/openSUSE/obs-service-source_validator/issues/134
We discussed that a bit further via email. To make it explicit: This only applies to packages that use source services. This doesn't make it mandatory to use them. As discussed in the team: Going forward we will treat issues like the one described by Jan as a security issue
Thank you!