EPEL Orphaned packages with vulnerabilities

[Till Maas]

On Thu, Aug 14, 2014 at 11:54:59AM +0200, Karel Volný wrote:

> >There is now a security initiative to handle the outstanding security
> >bugs.
> 
> that's cool that somebody cares
> 
> however, do you really think that users will appreciate this way of handling
> the bugs, i.e. removing important libraries instead of patching them?

If there is nobody that patches the library, I do not see how this is an
option.

> >>>Perhaps you can un-retire the package(s) and maintain them?
> >>
> >>why should I fix things *you* broke?
> >
> >Please calm down. If the package and its dependencies should stay in
> >EPEL, they need to be maintained.
> 
> probably my Google is broken, but I cannot find where this is set in stone?
> 
> I've always thought that it works in the way that if package gets orphaned,
> it simply won't make it into next version of the distribution, not that it
> should get removed from the current version, causing regressions for users
> ...?

For me it is kind of common sense. Why should it be a good idea to ship
packages with known vulnerabilities? As you can see from the long list
of orphaned packages with known vulnerabilities, just orphaning packages
in EPEL creates a dangerous situation where users installing packages
from EPEL assume they are well taken care of, but in reality they are
not. So I discussed this with others and retiring orphaned packages
after a certain time seemed good to us. However, I did not intentionally
retire a package that is depended upon, but since it is really easy to
undo retirement in EPEL, I do not see much harm done.

> >So if you would like to have the package in EPEL, you need to find
> >a maintainer or maintain it.
> 
> sorry, I just don't follow your logic
> 
> it wasn't me who did the action - why should I undo it?

I really do not get what what is your motivation. You are a package
maintainer with a package that depends on an orphaned library with
security vulnerabilities. Why do you not want to fix this? First you
wanted to get a better heads up, which I agree would have been better,
but I do not see how this would have changed anything, because still
nobody cares enough about libmodplug to unretire it and fix the security
vulnerability. Since you maintain a package that depends on it, you are
the first candidate to do this.

Regards
Till