Investigate Membership of linux-distros Mailing List #13

Open
opened 2026-07-07 17:03:21 +00:00 by thebeanogamer · 15 comments
Member

Right now Fedora doesn't have a representative on the linux-distros mailing list and things would be easier if we did. This is a private mailing list where vulnerabilities are pre-disclosed so distributions can prepare their updates and release them as soon as the embargo lifts.

Messages on this mailing list are sensitive and we'd get in a lot of trouble if they leaked, so let's make sure they don't.

Some questions that I have based on the discussions we've had:

  • Who should we send to the list?
    • As kernel maintainer, @jforbes seems like an obvious choice
    • A couple of other provenpackagers would be nice, so they can prep updates for other packages without needing to wait for the maintainer to respond
    • Non-proven packagers could also work, but with their commit access to all packages, proven seems much more useful.
  • Where should we track what gets reported?
    • Forgejo doesn't support private issues yet
    • Would Bugzilla bugs with the security checkbox ticked work? Who can even access those?
    • Some reports to the list wont have a CVE assigned yet, does that impact the process?
  • Do we need any paperwork around this?
  • How can we respond in a timely fashion to these reports.
    • Koji has no facility for private builds
    • Updates require karma
Right now Fedora doesn't have a representative on the [linux-distros mailing list](https://oss-security.openwall.org/wiki/mailing-lists/distros) and things would be easier if we did. This is a private mailing list where vulnerabilities are pre-disclosed so distributions can prepare their updates and release them as soon as the embargo lifts. Messages on this mailing list are sensitive and we'd get in a lot of trouble if they leaked, so let's make sure they don't. Some questions that I have based on the discussions we've had: * Who should we send to the list? * As kernel maintainer, @jforbes seems like an obvious choice * A couple of other provenpackagers would be nice, so they can prep updates for other packages without needing to wait for the maintainer to respond * Non-proven packagers could also work, but with their commit access to all packages, proven seems much more useful. * Where should we track what gets reported? * Forgejo doesn't support private issues yet * Would Bugzilla bugs with the security checkbox ticked work? Who can even access those? * Some reports to the list wont have a CVE assigned yet, does that impact the process? * Do we need any paperwork around this? * Agreement to sign for members. @salimma thinks no on this * Vulnerability response process (e.g. <https://wiki.gentoo.org/wiki/Project:Security/Pre-Release-Disclosure>) * How can we respond in a timely fashion to these reports. * Koji has no facility for private builds * Updates require karma
Owner

Just to make sure everyone knows, Fedora has no embargo process. Once a maintainer commits something to src.fedoraproject.org it's public. :)

I'd also worry about the load of people reading the list and filing private bugs, but I have no idea what the volume is, so perhaps it's fine...

Just to make sure everyone knows, Fedora has no embargo process. Once a maintainer commits something to src.fedoraproject.org it's public. :) I'd also worry about the load of people reading the list and filing private bugs, but I have no idea what the volume is, so perhaps it's fine...
Owner

Agreed today:

  • Bugzilla would be used for private tickets for linux-distros, if we are added.
  • A policy shall be drafted first, and then presented to FESCo for their feedback.

General tendency: 1+ proven packager might be nice, but not a requirement, other things are relevant too (our AI bot ain't bad:). Having 2 people added seems to be the preference. The policy draft will precede a decision of who that should be. There is a consensus that @jforbes should be one of them.

First topic of today's meeting:
https://meetbot.fedoraproject.org/meeting-3_matrix_fedoraproject-org/2026-07-09/security-sig.2026-07-09-15.04.log.html
https://meetbot.fedoraproject.org/meeting-3_matrix_fedoraproject-org/2026-07-09/security-sig.2026-07-09-15.04.html

Agreed today: - Bugzilla would be used for private tickets for linux-distros, if we are added. - A policy shall be drafted first, and then presented to FESCo for their feedback. General tendency: 1+ proven packager might be nice, but not a requirement, other things are relevant too (our AI bot ain't bad:). Having 2 people added seems to be the preference. The policy draft will precede a decision of who that should be. There is a consensus that @jforbes should be one of them. First topic of today's meeting: https://meetbot.fedoraproject.org/meeting-3_matrix_fedoraproject-org/2026-07-09/security-sig.2026-07-09-15.04.log.html https://meetbot.fedoraproject.org/meeting-3_matrix_fedoraproject-org/2026-07-09/security-sig.2026-07-09-15.04.html
Owner

Related to linux-distros discussion regarding incentives for policies etc:
https://almalinux.org/security/
https://almalinux.org/p/vulnerability-disclosure-policy/

Related to linux-distros discussion regarding incentives for policies etc: https://almalinux.org/security/ https://almalinux.org/p/vulnerability-disclosure-policy/
Owner

@jforbes off the cuff I would say we need a new component (e.g., linux-distros or whatsoever) in our bugzilla, right?

That way we can add the intended participants automatically to the very tickets, but no one else (at least not automatically). Everything else feels error prone. I still ask because the last time I worked with a private bugzilla ticket was an SELinux case ~1 year ago, so I might miss some possibilities (?)

@jforbes off the cuff I would say we need a new component (e.g., `linux-distros` or whatsoever) in our bugzilla, right? That way we can add the intended participants automatically to the very tickets, but no one else (at least not automatically). Everything else feels error prone. I still ask because the last time I worked with a private bugzilla ticket was an SELinux case ~1 year ago, so I might miss some possibilities (?)
Member

That would be a good way to make sure that the full set of package maintainers can not see the information, only the individual who is read in. The bugzilla tickets need to be created by the persons who are representing Fedora on the list. The tickets are created against the package being read in as private tickets. I believe there are a couple of bits we need to consider before creating those tickets though.

  1. We need some sort of written embargo handling instructions/polcies that maintainers can agree to.
  2. Maintainer should be contacted before the bug is created to see if they are willing to be read in and agree to embargo terms. We would need a way to do this without disclosing what/where/when.
  3. We can offer to provide a pull request and or notification when the embargo is lifted for those packagers who do not want the responsibility of being read in.
That would be a good way to make sure that the full set of package maintainers can not see the information, only the individual who is read in. The bugzilla tickets need to be created by the persons who are representing Fedora on the list. The tickets are created against the package being read in as private tickets. I believe there are a couple of bits we need to consider before creating those tickets though. 1. We need some sort of written embargo handling instructions/polcies that maintainers can agree to. 2. Maintainer should be contacted before the bug is created to see if they are willing to be read in and agree to embargo terms. We would need a way to do this without disclosing what/where/when. 3. We can offer to provide a pull request and or notification when the embargo is lifted for those packagers who do not want the responsibility of being read in.
Member

I think we should call it distribution-private, so it's not specific to the list.

I think we should call it `distribution-private`, so it's not specific to the list.
Owner

Some initial thoughts of what could be contained in a potential policy:

  • Pre-Disclosure-handling is organized and handled only in the bugzilla component distribution-private (name to be adjusted)
  • The tickets have to be kept private before disclosure
  • People who are assigned to the component (and thus automatically involved/informed) must be members of the Security SIG (owner or member FAS group?) and approved by FESCo
  • Exception 1: Security SIG members who are members of linux-distros can be added to the component without FESCo approval
  • Exception 2 (overlapping with exception 1): Representatives of Fedora or its downstream distributions (considering only: CentOS Stream including its SIGs, AlmaLinux, RockyLinux) who are confirmed to be members of linux-distros (and acting as any of these distributions' representatives in linux-distros) can be added at the discretion of the Security SIG, without FESCo approval
  • The Security SIG shall try to have always at least one proven packager to be a member of the component
  • Within a given pre-disclosure ticket, other contributors can be added to the private ticket if their contribution is critical for the ticket to be solved (e.g., packager of an affected package): adding them is possible only if there is a consensus within the ticket to do so (no -1).
  • Only contributors who signed the Fedora Pre-Disclosure-Agreement FPDA can be added to the component and to tickets in general (maybe in FAS like the FPCA?)
    -> FPDA (name to be adjusted) must be drafted -> might involve legal team?
  • members of the component can become active in tickets at their discretion
  • Once a ticket has been solved and its embargo(s) lifted, the ticket must be made public within 1 week.
  • Involved proven packager can use their privileges exceptionally if it is security critical and if the packagers who would otherwise be responsible have not signed the FPDA or if they reject to implement necessary means on time. There must be a consensus within the ticket (excluding the affected packager) to allow this. This consensus must include at least 3 members who are members of the component.
  • Complaints about privilege use of proven packagers are to be handled by FESCo.
  • Justin's final point might also be added in some way (I think his other two are already incorporated above):

We can offer to provide a pull request and or notification when the embargo is lifted for those packagers who do not want the responsibility of being read in.

There is much to criticize about this, but it might be something to start a discussion with and bring up some questions...

Supplement 1: For contacting others, before they are added to a ticket, Matrix PM (end to end encryption) might be useful?

Supplement 2: "all information of the component shall be used only for purposes relevant for the security of the mentioned Linux distributions and/or the Linux-distros mailing list."

Some initial thoughts of what could be contained in a potential policy: - Pre-Disclosure-handling is organized and handled only in the bugzilla component `distribution-private` (name to be adjusted) - The tickets have to be kept private before disclosure - People who are assigned to the component (and thus automatically involved/informed) must be members of the Security SIG (owner or member FAS group?) and approved by FESCo - Exception 1: Security SIG members who are members of `linux-distros` can be added to the component **without** FESCo approval - Exception 2 (overlapping with exception 1): Representatives of Fedora or its downstream distributions (considering only: CentOS Stream including its SIGs, AlmaLinux, RockyLinux) who are confirmed to be members of `linux-distros` (and acting as any of these distributions' representatives in `linux-distros`) can be added at the discretion of the Security SIG, without FESCo approval - The Security SIG shall try to have always at least one proven packager to be a member of the component - Within a given pre-disclosure ticket, other contributors can be added to the private ticket if their contribution is critical for the ticket to be solved (e.g., packager of an affected package): adding them is possible only if there is a consensus within the ticket to do so (no `-1`). - Only contributors who signed the Fedora Pre-Disclosure-Agreement **FPDA** can be added to the component and to tickets in general (maybe in FAS like the FPCA?) -> FPDA (name to be adjusted) must be drafted -> might involve legal team? - members of the component can become active in tickets at their discretion - Once a ticket has been solved and its embargo(s) lifted, the ticket must be made public within 1 week. - Involved proven packager can use their privileges exceptionally if it is security critical and if the packagers who would otherwise be responsible have not signed the FPDA or if they reject to implement necessary means on time. There must be a consensus within the ticket (excluding the affected packager) to allow this. This consensus must include at least 3 members who are members of the component. - Complaints about privilege use of proven packagers are to be handled by FESCo. - Justin's final point might also be added in some way (I think his other two are already incorporated above): > We can offer to provide a pull request and or notification when the embargo is lifted for those packagers who do not want the responsibility of being read in. There is much to criticize about this, but it might be something to start a discussion with and bring up some questions... Supplement 1: For contacting others, before they are added to a ticket, Matrix PM (end to end encryption) might be useful? Supplement 2: "all information of the component shall be used only for purposes relevant for the security of the mentioned Linux distributions and/or the `Linux-distros` mailing list."
Owner

This incorporates thoughts of the meeting logs, but I am not sure if it is appropriate to allow any (Security SIG) members who ain't members of the linux-distros list to be auto-involved in the component?

This incorporates thoughts of the meeting logs, but I am not sure if it is appropriate to allow any (Security SIG) members who ain't members of the linux-distros list to be auto-involved in the component?
Author
Member

From talking to the Samba folks, I think the ticket approach described here would work. Users in the appropriate FAS group can see the ticket pre-disclosure and we can just move the ticket out of that component once the embargo lifts. IIRC, Red Hat's bugzilla is maintained by @agk who we'd probably need help from to implement this.

From talking to the Samba folks, I think the ticket approach described here would work. Users in the appropriate FAS group can see the ticket pre-disclosure and we can just move the ticket out of that component once the embargo lifts. IIRC, Red Hat's bugzilla is maintained by @agk who we'd probably need help from to implement this.

In bugzilla, security is controlled by groups, bug-by-bug. For example, we might create a new "secure" group for embargoed Fedora security bugs and limit the access to the small team. You would then put embargoed bugs into that group. Bugzilla's emails then just say "something changed on bug number N" unless you provide a GPG key so it can encrypt your email. You could have a "secure" security-embargoed component which would mean its bugs have to be private when they are created, or you could handle it within the existing components controlling the assignees yourself when creating the bugs.

Alternatively you could set up a separate "Fedora Security" product, separate from "Fedora" and lock that down more tightly. (One like that already exists from the past.)

In bugzilla, security is controlled by groups, bug-by-bug. For example, we might create a new "secure" group for embargoed Fedora security bugs and limit the access to the small team. You would then put embargoed bugs into that group. Bugzilla's emails then just say "something changed on bug number N" unless you provide a GPG key so it can encrypt your email. You could have a "secure" security-embargoed component which would mean its bugs have to be private when they are created, or you could handle it within the existing components controlling the assignees yourself when creating the bugs. Alternatively you could set up a separate "Fedora Security" product, separate from "Fedora" and lock that down more tightly. (One like that already exists from the past.)

We also have available the bugzilla "rules engine" which can provide automation (and after-the-fact validation, enforcing rules).

We also have available the bugzilla "rules engine" which can provide automation (and after-the-fact validation, enforcing rules).
Owner

As discussed, I will provide a draft in a PR for #13 (comment)

-> I will keep Neal's suggested component name distribution-private for now, but we can change that later to fedora-security (which was brought up in the meeting today). Personally I find both ok.

-> I implement the publishing at the end in a transparent way that allows the discussed case-by-case flexibility: allowing to re-assign the private ticket to the real component or opening a new ticket at the real component with a link to the private one. Deriving from the feedback in the meeting: I will formulate it for now to prefer a new ticket at the real component (with a link) in case of a doubt, unless it is ensured no harm can rise if the private ticket is re-assigned to the public component.

-> I will keep it neutral to the used service, only assuming a private ticket service. May it be bugzilla, forge, or whatever. With easy-to-update links to the very service. Yet, using "component" is already something specific: I keep it in a way that can be easily updated to "repos" or so, without the need for a major reformulation/revision if the concepts are not equal.

-> I will assume the sec-bugzappers FAS group for the component.

-> I assume a component, not a separated product in bugzilla for now.

I try to provide the PR before the next meeting. At least something that can be discussed. The branch will be open for changes by other team members (I keep it in the SIG repo).

Not yet clear:

-> can we sign up the component to the mailing list with a service?

-> should or must the FAS group sec-bugzappers be unconditionally equal to the mailing list members?

As discussed, I will provide a draft in a PR for https://forge.fedoraproject.org/security/tickets/issues/13#issuecomment-1060887 -> I will keep Neal's suggested component name `distribution-private` for now, but we can change that later to `fedora-security` (which was brought up in the meeting today). Personally I find both ok. -> I implement the publishing at the end in a transparent way that allows the discussed case-by-case flexibility: allowing to re-assign the private ticket to the real component or opening a new ticket at the real component with a link to the private one. Deriving from the feedback in the meeting: I will formulate it for now to prefer a new ticket at the real component (with a link) in case of a doubt, unless it is ensured no harm can rise if the private ticket is re-assigned to the public component. -> I will keep it neutral to the used service, only assuming a private ticket service. May it be bugzilla, forge, or whatever. With easy-to-update links to the very service. Yet, using "component" is already something specific: I keep it in a way that can be easily updated to "repos" or so, without the need for a major reformulation/revision if the concepts are not equal. -> I will assume the `sec-bugzappers` FAS group for the component. -> I assume a component, not a separated product in bugzilla for now. I try to provide the PR before the next meeting. At least something that can be discussed. The branch will be open for changes by other team members (I keep it in the SIG repo). **Not yet clear:** -> can we sign up the component to the mailing list with a service? -> should or must the FAS group `sec-bugzappers` be unconditionally equal to the mailing list members?
Owner

PR: security/docs#17

See text of PR -> Security SIG members can edit the PR -> feel free :)

Supplement: this PR is CLOSED -> see next post!

PR: https://forge.fedoraproject.org/security/docs/pulls/17 See text of PR -> Security SIG members can edit the PR -> feel free :) **Supplement: this PR is CLOSED -> see next post!**
Owner

Supplement, I had to create a new PR, as fast-forward in the test window to verify if it solves the test seems to lead to an auto-merge... I already reverted the mess. The new PR is here: security/docs#18

#17 is closed and the commits removed again from the target branch.

See text of PR -> Security SIG members can edit the PR -> feel free :)

Supplement, I had to create a new PR, as fast-forward in the test window to verify if it solves the test seems to lead to an auto-merge... I already reverted the mess. The new PR is here: https://forge.fedoraproject.org/security/docs/pulls/18 [#17](https://forge.fedoraproject.org/security/docs/pulls/17#issuecomment-1079767) is closed and the commits removed again from the target branch. See text of PR -> Security SIG members can edit the PR -> feel free :)
Owner

Regarding security/docs#18 (comment) : In the meeting of 6.8.2026, we agreed that the next step is to ask Legal if we will need a "Fedora Pre-Disclosure-Agreement" (FPDA) or if the PR with the policies in combination with the contributor agreement are sufficient to comply and to protect the Linux-Distros mailing list from our PoW.

Everyone is free to take over this task. People can in parallel review and improve the document, which presumes the FPDA only in a few paragraphs: so most parts of the policies are not affected by any Legal suggestion anyway.

Until then, I remove this from the meeting in #13 . Everyone is free to add it again when something specific is to be discussed or if there is any progress.

Regarding https://forge.fedoraproject.org/security/docs/pulls/18#issuecomment-1261951 : In the meeting of 6.8.2026, we agreed that the next step is to ask Legal if we will need a "Fedora Pre-Disclosure-Agreement" (FPDA) or if the PR with the policies in combination with the contributor agreement are sufficient to comply and to protect the Linux-Distros mailing list from our PoW. Everyone is free to take over this task. People can in parallel review and improve the document, which presumes the FPDA only in a few paragraphs: so most parts of the policies are not affected by any Legal suggestion anyway. Until then, I remove this from the meeting in https://forge.fedoraproject.org/security/tickets/issues/13 . Everyone is free to add it again when something specific is to be discussed or if there is any progress.
Sign in to join this conversation.
No labels
meeting
No milestone
No project
No assignees
6 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
security/tickets#13
No description provided.