golang September 2022

golang@lists.fedoraproject.org

5 participants
6 discussions

[go-rpm-macros] Issue #50: arched devel packages
by Mikel Olasagasti 16 Sep '22

16 Sep '22

mikelo2 reported a new issue against the project: `go-rpm-macros` that you are following: `` Currently there is no option to ship arched devel packages. The ask is to have a macro, `%go_arched_devel` for example, to allow certain packages's devel package, `golang-x-crypto` for example, to be arched rather than noarch, so package depending on them can benefit from extra performance. The rest of the devel packages that don't declare the macro would be still noarch. `` To reply, visit the link below or just reply to this email https://pagure.io/go-rpm-macros/issue/50

2 2

[go-rpm-macros] PR #47: Use Fedora's build flags for cgo.
by Maxwell G 13 Sep '22

13 Sep '22

gotmax23 opened a new pull-request against the project: `go-rpm-macros` that you are following: `` Use Fedora's build flags for cgo. `` To reply, visit the link below or just reply to this email https://pagure.io/go-rpm-macros/pull-request/47

2 6

[Fedocal] Reminder meeting : Go SIG
by jcajka＠fedoraproject.org 11 Sep '22

11 Sep '22

Dear all, You are kindly invited to the meeting: Go SIG on 2022-09-12 from 20:00:00 to 21:00:00 Europe/Prague At fedora-golang(a)libera.chat The meeting will be about: Fedora's Go SIG meeting More information available at: [https://pagure.io/GoSIG/go-sig/](https://pagure.io/GoSIG/go-sig/) Source: https://calendar.fedoraproject.org//meeting/10012/

1 0

Thread to send your Golang package reviews which are waiting
by Robert-André Mauchin 09 Sep '22

09 Sep '22

Thread to send your Golang package reviews which are waiting... reply to this thread so we can sync up our efforts. Best regards Robert-André

5 5

CVE Tracking Bugs
by Maxwell G 07 Sep '22

07 Sep '22

Hi Fedorians, I think the security tracking bug filing process needs to be amended. The current process is quite frustrating for me and other contributors. This is especially bad for Go CVEs, which there are lot of. Red Hat Product Security creates a single tracking bug for Fedora{, EPEL} _and_ all Red Hat products and CCs a bunch of Fedora maintainers. They then create separate bugs for each package that they deem affected. The affected packages are oftened determined in a manner that appears overzealous and arbitrary. After the bugs are created, we get spammed with a bunch of notifications about private bugs, RH product errata, and various other things that are completely irrelevant to Fedora. These messages flood my Bugzilla mailbox and obscure actual issues that I need to address. I do not really care whether a Go CVE has been mitigated in Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8" or "Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8" or "Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8." --- Some particularly egregious examples: I maintain an Ansible kubernetes collection, and they reported it as vulnerable to some CVE with a specific Openshift component. The collection not vulnerable. They provided no actionable information, and the description was unclear. When I asked why it was reported, they said that the package "used OpenShift." A couple Go CVEs ago[^1], they created bugs against hundreds of Go libraries. They arbitrarily chose branches and packages. The bugs were not actionable by packagers of individual go libraries. Only applications that provide binaries need to be rebuilt. They were reported shortly before the F34 EOL, so we got a huge amount of emails after the bugs were automatically closed. In fact, a Go packager reported that these messages from the _security_ team DOSed their mail server. To their credit, they have fixed this issue after one of the other Go SIG people talked to them. Now, these bugs are only filed against the golang component. [^1]: Really, it was a couple Go releases ago. There are multiple CVEs reported with each Go release these days. Another time, their automation posted the exact same comment over 200 times. --- First and foremost, there needs to be a clear way for packagers to report problems with this process to prodsec. I don't think Fedora packagers should be CCed on these global trackers. We could create a separate "Security Response" component under the "Fedora" Bugzilla product to create tracker bugs for CVEs that affect multiple Fedora components, or we could ask prodsec to only CC Fedora maintainers on the child, package-level bugs. I guess I could acomplish what I'm proposing by filtering out mails with "X-Bugzilla-Product: Security Response" headers and not have gone on this rant, but I still think this needs to be addressed. Does anyone know how to reach prodsec about this? -- Best, Maxwell G (@gotmax23) Pronouns: He/Him/His

2 1

[go-rpm-macros] PR #49: Add RPM generator for bundled Provides
by Maxwell G 02 Sep '22

02 Sep '22

gotmax23 opened a new pull-request against the project: `go-rpm-macros` that you are following: `` Add RPM generator for bundled Provides `` To reply, visit the link below or just reply to this email https://pagure.io/go-rpm-macros/pull-request/49

2 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

golang September 2022