MIME-Version: 1.0
References: 
 <CAD59NR0X7w6N-8o+rGUPcyH+gbBLc6CGPRVRZy_UsAB73s3tTA@mail.gmail.com>
 <20190723091240.733103de@ncopa-desktop.copa.dup.pw>
 <CAD59NR0z51BV+n3T0NJOdURG6AVu=x0e89eXv8ZZU+-PkcGBMA@mail.gmail.com>
 <CA+cSEmNmtj3m458Gu4ZYh4VwtMFw2xEGq38bs_+vcLosNr2ZRg@mail.gmail.com>
 <CAD59NR2GuL0hAEp70DCf2WvL8zKQKHTGfxoeng4wLE3SB1xNnQ@mail.gmail.com>
 <20190723111532.5a18f982@ncopa-desktop.copa.dup.pw>
 <CAD59NR1rMTYu06Gd4fjxhpPJSYyCwFZv9WDm35MbQxHJN2NqzQ@mail.gmail.com>
 <CAD59NR0KfYZv1=7c7py03nOkqnzYsoT0LgfFZStCHw68+WLjwg@mail.gmail.com>
 <20190814230125.62d8de16@ncopa-desktop.copa.dup.pw>
In-Reply-To: <20190814230125.62d8de16@ncopa-desktop.copa.dup.pw>
From: Teppei Fukuda <knqyf263@gmail.com>
Date: Sat, 17 Aug 2019 16:29:00 -1000
Message-ID: 
 <CAD59NR3guf7KaBom-9=mqq16SFzBOWry=s52QPD3jewkLzAa-g@mail.gmail.com>
Subject: Re: Security Issues in Redmine
To: Natanael Copa <ncopa@alpinelinux.org>
Cc: Carlo Landmeter <clandmeter@alpinelinux.org>,
 ~alpine/devel@lists.alpinelinux.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Copa,

Thank you for the kind response.

I looked over all recent commits. I think the reported security issues
in GitLab is sufficient as a first step. Of course, there are many
better ways such as preparing a system for vulnerability management.
However, it is hard to maintain. I believe the most important thing is
sustainability.

For maintainers, it should be easier to just write markdown for
Issue/PR. Therefore, I think it is enough to parse markdown and
generate security advisories. We need to fix the format of the
security issues. The GiaLab "description templates" may be a good idea
to fix the format.
https://docs.gitlab.com/ee/user/project/description_templates.html

If possible, let's have a video meeting!

Best regards,
Teppei

2019=E5=B9=B48=E6=9C=8814=E6=97=A5(=E6=B0=B4) 11:01 Natanael Copa <ncopa@al=
pinelinux.org>:
>
> Hi,
>
> On Sun, 11 Aug 2019 14:29:50 -1000
> Teppei Fukuda <knqyf263@gmail.com> wrote:
>
> > Hi Copa,
> >
> > My apologies for keeping asking you questions, but I have one more ques=
tion.
> >
> > When I've been following the recent security related commits of
> > alpine/aports, I've noticed that you always write secfixes comment
> > even if they were not backported fixes. Was this defined as a rule?
>
> No, it was never an expressed or documented rule or request or
> anything. The community have just filled in the secfixes data, so it
> seems that is the direction things are "naturally" going.
>
> We have recently also moved to gitlab and have tried various ways to
> report the issues. Gitlab has made things simpler, for example we are
> now using one issue with tasklist of affected branches. We have also
> started to add the commit data where the issue is fixed. This seems to
> work relatively well and combined with the secfixes data, this is a
> good step forward to an advisory program.
>
> > As I mentioned before, I hope that security advisories of Alpine will
> > be provided. So I would like to help if I can do anything.
>
> Can you please have a look at the recent security fixes in gitlab and
> see what you think, and what we could do differently.
> https://gitlab.alpinelinux.org/alpine/aports/issues?scope=3Dall&utf8=3D%E=
2%9C%93&state=3Dclosed&label_name[]=3DSecurity
>
> I specifically wonder how to report multiple CVEs that affect different
> branches. See for example
> https://gitlab.alpinelinux.org/alpine/aports/issues/10699
>
> Do you think that tracking the security data in secfixes comments in
> APKBUILDs and the reported security issues in gitlab is sufficient? We
> could probably start also report the issues that we have fixed already,
> with the commit with the fix.
>
> >
> > I know you are so busy. It would be appreciated if I discuss this with
> > you when you have time.
>
> Would you like to have a video conference meeting?
>
> -nc
>
> >
> >
> > Best regards,
> > Teppei
> >
> > 2019*7*23*(*) 16:56 Teppei Fukuda <knqyf263@gmail.com>:
> > >
> > > Hi Copa,
> > >
> > > I appreciate your polite explanation. I understand.
> > >
> > > Currently, my program collects the following data:
> > > 1. the secfixes comments in APKBUILD
> > > 2. alpine-secdb (maybe the same as above)
> > > 3. the security tickets of Redmine (will be replaced with the
> > > issues of GitLab) 4. git diff APKBUILD (only commits related with
> > > the above issues)
> > >
> > > I think we can generate the security advisories by checking all git
> > > log like No. 4. For example, the following commit fixes
> > > CVE-2019-13636.
> > > https://github.com/alpinelinux/aports/pull/9642/files
> > >
> > > Watching this diff of main/patch/APKBUILD, we can detect the version
> > > update from 2.7.6-r4 to 2.7.6-r5. This is my source code doing it.
> > > https://github.com/knqyf263/vuln-list-update/blob/d8aefa60155637561a8=
a2d3feb486bbb675c996c/alpine/alpine.go#L404-L450
> > >
> > > I know this way is not perfect. There may be false
> > > positive/negative. However, this process can be automated and the
> > > maintenance cost is low. It may be a good way as a first step of
> > > the security advisory. It is better if the format of the commit
> > > message is fixed. e.g. [os_version] pkgname: fix CVE-ID.
> > >
> > > I want the security database of Alpine strongly and can help you in
> > > the task of investigating it and writing an automation program. But,
> > > It is difficult to do manual operation (e.g. I continue to fill the
> > > security information manually).
> > >
> > > Best,
> > > Teppei
> > >
> > > 2019*7*23*(*) 18:18 Natanael Copa <ncopa@alpinelinux.org>:
> > > >
> > > > On Tue, 23 Jul 2019 17:54:40 +0900
> > > > Teppei Fukuda <knqyf263@gmail.com> wrote:
> > > >
> > > > > Hi Carlo,
> > > > >
> > > > > Yes, it is. However, alpine-secdb is database of backported
> > > > > fixes as README says.
> > > > > >It is not a complete database of all security issues in
> > > > > >Alpine.
> > > > >
> > > > > I need a complete database of all security issues.
> > > >
> > > > We currently don't have that. I do think we have much or maybe
> > > > even most of the needed data, but its spread.
> > > >
> > > > We need someone who can figure out the pieces that is missing and
> > > > find a way to collect and store it in a way that makes it as
> > > > simple as possible to fix and roll out fixes.
> > > >
> > > > We could for example use the secfixes comments in APKBUILD and
> > > > data from gitlab issues and generate a database from that, and
> > > > have someone fill in the missing data, or we could turn it
> > > > around, have someone collect all the data in a database and
> > > > generate issues from that and maybe automatically add secfixes
> > > > comments from it.
> > > >
> > > > But we need someone who can investigate and come up with a good
> > > > plan.
> > > >
> > > > -nc
>