Fedora Legacy needs help!

[David Eisenstein]

Hi Fedora-Security folks:  

We in Fedora Legacy have been having severe manpower shortages in getting work
done for security issues relating to Fedora Core releases that have been turned
over to our care.  Basically, no new packages that fix security issues have been
released by Fedora Legacy since late July.

http://www.redhat.com/archives/fedora-legacy-announce/2006-July/date.html
http://www.redhat.com/archives/fedora-legacy-announce/2006-August/date.html
http://www.redhat.com/archives/fedora-legacy-announce/2006-September/date...
http://www.redhat.com/archives/fedora-legacy-announce/2006-October/date.html

 -- those pretty much tell the story.  

Also, a 3+-month-old Legacy status report here
             <http://fedoraproject.org/wiki/Legacy/Status>;.

A fellow contributor says that, essentially, Fedora Legacy is providing a false
sense of security to people who point their yum at our repositories.  If that
is the case ... ?!

We need help!  Any suggestions/advice on how/where we can get help getting our
work done?

Thanks in advance!

    Warm regards,
    David Eisenstein

[Mark Cox]

>  We need help!  Any suggestions/advice on how/where we can get help
> getting our
>  work done? 
Would limiting the scope of errata support help stop Legacy being 
overwhelmed with updates?

In my opinion if Legacy was a project that fixed only security issues 
rated severity critical (plus say kernel privilege escalation issues), it 
would still be providing an important level of protection to users whilst 
limiting the amount of work.  For example for Enterprise Linux 4 we issued 
about 20 updates a year that would fall into this category.
http://www.redhat.com/security/updates/classification/

In fact this is something we've started to do for Red Hat products; the 
Red Hat Application Stack product comes with two years of full support, 
followed by a year of security support for critical severity issues only.

Mark

[Jesse Keating]

On Monday 09 October 2006 03:53, Mark J Cox wrote:
>  Would limiting the scope of errata support help stop Legacy being
>  overwhelmed with updates?
>
>  In my opinion if Legacy was a project that fixed only security issues
>  rated severity critical (plus say kernel privilege escalation issues), it
>  would still be providing an important level of protection to users whilst
>  limiting the amount of work.  For example for Enterprise Linux 4 we issued
>  about 20 updates a year that would fall into this category.
>  http://www.redhat.com/security/updates/classification/ 
I think this might be acceptable.  We're still in a major hole wrt RHL7.3/RHL9 
and FC3/4 that we'd have to dig our way out of, even if we limited it to 
Critical severity stuff, and this is where we need some initial help to dig 
our way out to a manegable workflow.

-- 
Jesse Keating
Release Engineer: Fedora