Message-ID: <1458852606.9023.4.camel@c89m3s1>
Subject: Re: [alpine-devel] Alpine security tracker
From: Leonardo Arena <rnalrd@gmail.com>
To: Quentin Machu <quentin.machu@coreos.com>
Cc: alpine-devel@lists.alpinelinux.org
Date: Thu, 24 Mar 2016 21:50:06 +0100
In-Reply-To: <CANtECw8gn93aiQ4qGoGcM3TJ4C6vLAK45cp62_nmHEL1usfg7A@mail.gmail.com>
References: 
	<CANtECw8gn93aiQ4qGoGcM3TJ4C6vLAK45cp62_nmHEL1usfg7A@mail.gmail.com>
Content-Type: multipart/signed; micalg="pgp-sha1"; protocol="application/pgp-signature";
	boundary="=-kA6xRrBVEpCdSGwoxPHG"
Precedence: list
Mime-Version: 1.0


--=-kA6xRrBVEpCdSGwoxPHG
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Il giorno gio, 24/03/2016 alle 16.34 -0400, Quentin Machu ha scritto:
> Hi,
>=20

Hi,

>=20
> My name=E2=80=99s Quentin Machu and I am the primary maintainer of Clair =
[1],
>  an open source project for the static analysis of vulnerabilities in
> containers, by CoreOS. The project, which aim at bringing security
> awareness to everyone, recently went 1.0 [2] and is considerably well
> received by the community.
>=20
>=20
> As Alpine grows more and more popular, especially for containers to
> which it becomes a really common base image, I believe that it would
> be extremely valuable for Alpine to track vulnerabilities that may
> affect its packages.=20

We already do that in our bug traker:
https://bugs.alpinelinux.org/projects/alpine/issues?set_filter=3D1&status_i=
d=3Dc&tracker_id=3D1


> Several Linux distributions, such as Debian [3][4], Ubuntu [5][6],
> RHEL [7][8], Arch [9], already do through advisories and parsable
> databases.
>=20

We don't issue our own advisories if that's what you mean. That would
require more man power which I think we prefer to spend on fixing the
security issues.

- leo


--=-kA6xRrBVEpCdSGwoxPHG
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAABAgAGBQJW9FL+AAoJELAPckZGG2T6lW8IAIyDBxg61zhEcJSzZzLBf2/3
3Pp3XEq99MgdUMyMbmhLPwTRtTDBg85yxwgFOuZX3T05rDeZO87plocCheCStCF+
F4D/dTWT3urqsGC5l3jEzLR9vpOgqqNLWcOxpMkTvHZ+xrNvEvluohbeYe0eDLrk
7alfzBb1xKWkjMyLDIAbUIdrdD+l4DTqZR0xbq1q/Th7G0TZ0wAQhPOE0vW+QH/o
nWBv2Wtphotd5vXU3IIglJQ+91mJu7gBsM2l3+GqbODZKrktieHaJ9dhZaIdxW4c
rcaK6aQtZiP2XpgXDcnNojmYlHpaSIB5bf9FKc43BmWgXP8FGoqmZEsgde2sLOI=
=zC7E
-----END PGP SIGNATURE-----

--=-kA6xRrBVEpCdSGwoxPHG--



---
Unsubscribe:  alpine-devel+unsubscribe@lists.alpinelinux.org
Help:         alpine-devel+help@lists.alpinelinux.org
---