On Fri, 2006-06-02 at 02:41 -0500, David Eisenstein wrote: > A more general question is this: How do we in Fedora Legacy track > vulnerabilities and make sure that we are aware of all the relevant > vulnerabilities for the packages that we maintain, and haven't missed > something? > > The fedora-security-list and Josh Bressers are using audit files to track > all relevant security vulnerabilities for their sets of packages, which > are kept in CVS here, > <http://cvs.fedora.redhat.com/viewcvs/fedora-security/audit/?root=fedora> > > but we here in Fedora Legacy haven't started using this kind of tool yet. > Is it time for us to start doing so? If so, are any of you interested in > forming some kind of vulnerability tracking team and getting started on > such list(s) for the products we maintain? It seems to me that whatever system used by the Fedora Security Team should be adopted by Fedora Legacy after discussion with the relevant contributors. Rahul
