<div dir="ltr">On Tue, Jun 4, 2013 at 9:29 AM, Roman Bogorodskiy <span dir="ltr"><<a href="mailto:bogorodskiy@gmail.com" target="_blank">bogorodskiy@gmail.com</a>></span> wrote:<br><div class="gmail_extra"><div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5"> Daniel P. Berrange wrote:<br>
<br>
> On Tue, Jun 04, 2013 at 09:33:15AM -0600, Eric Blake wrote:<br>
> > On 06/04/2013 04:06 AM, Daniel P. Berrange wrote:<br>
> > > From: "Daniel P. Berrange" <<a href="mailto:berrange@redhat.com">berrange@redhat.com</a>><br>
> > ><br>
> > > Historically security issues in libvirt have been primarily<br>
> > > triaged & fixed by the Red Hat libvirt members & Red Hat<br>
> > > security team, who then usually notify other vendors via<br>
> > > appropriate channels. There have been a number of times<br>
> > > when vendors have not been properly notified ahead of<br>
> > > announcement. It has also disadvantaged community members<br>
> > > who have to backport fixes to releases for which there are<br>
> > > no current libvirt stable branches.<br>
> > ><br>
> > > To address this, we want to make the libvirt security process<br>
> > > entirely community focused / driven. To this end I have setup<br>
> > > a new email address "<a href="mailto:libvirt-security@redhat.com">libvirt-security@redhat.com</a>" for end<br>
> > > users to report bugs which have (possible) security implications.<br>
> > ><br>
> > > This email addr is backed by an invitation only, private<br>
> > > archive, mailing list. The intent is for the list membership<br>
> > > to comprise a subset of the libvirt core team, along with any<br>
> > > vendor security team engineers who wish to participate in a<br>
> > > responsible disclosure process for libvirt. Members of the<br>
> > > list will be responsible for analysing the problem to determine<br>
> > > if a security issue exists and then issue fixes for all current<br>
> > > official stable branches & git master.<br>
> > ><br>
> > > I am proposing the following libvirt core team people as<br>
> > > members of the security team / list (all cc'd):<br>
> > ><br>
> > > Daniel Berrange (Red Hat)<br>
> > > Eric Blake (Red Hat)<br>
> > > Jiri Denemar (Red Hat)<br>
> > > Daniel Veillard (Red Hat)<br>
> > > Jim Fehlig (SUSE)<br>
> > > Doug Goldstein (Gentoo)<br>
> > > Guido Günther (Debian)<br>
> > ><br>
> > > We don't have anyone from Ubuntu on the libvirt core team.<br>
> > > Serge Hallyn is the most frequent submitter of patches from<br>
> > > Ubuntu in recent history, so I'd like to invite him to join.<br>
> > > Alternatively, Serge, feel free to suggest someone else to<br>
> > > represent Ubuntu's interests.<br>
> ><br>
> > Is it worth adding any BSD representation? Roman Bogorodskiy might be<br>
> > the best candidate on that front.<br>
><br>
> Yep, meant to mention that. I was not sure whether any *BSD is actually<br>
> distributing formal libvirt packages to users yet, or if they're still<br>
> just at the code porting stage. Roman, what's the status of the FreeBSD<br>
> port / packaging effort from your POV ?<br>
<br>
</div></div>FreeBSD has libvirt port:<br>
<br>
<a href="http://www.freshports.org/devel/libvirt/" target="_blank">http://www.freshports.org/devel/libvirt/</a><br>
<br>
It is maintained by Jason Helfman (CCed), so I think he's more<br>
appropriate person for such kind of things. From my side, I'd<br>
be happy to help also.<br>
<span class="HOEnZb"><font color="#888888"><br>
Roman Bogorodskiy<br>
</font></span></blockquote></div><br>Packages are supplied to users as part of our standard package distribution sets for releases and standard updates of our package sets.</div><div class="gmail_extra">It has been distributed as a package since it was committed to the FreeBSD ports tree.</div>
<div class="gmail_extra"><br></div><div class="gmail_extra">-jgh</div><div class="gmail_extra"> <br>--<br>Jason Helfman | FreeBSD Committer<br>jgh@FreeBSD.org | <a href="http://people.freebsd.org/%7Ejgh" target="_blank">http://people.freebsd.org/~jgh</a> | The Power to Serve<br>
</div></div>