Date: Wed, 14 Aug 2019 23:01:25 +0200
From: Natanael Copa <ncopa@alpinelinux.org>
To: Teppei Fukuda <knqyf263@gmail.com>
Cc: Carlo Landmeter <clandmeter@alpinelinux.org>,
 ~alpine/devel@lists.alpinelinux.org
Subject: Re: Security Issues in Redmine
Message-ID: <20190814230125.62d8de16@ncopa-desktop.copa.dup.pw>
In-Reply-To: 
 <CAD59NR0KfYZv1=7c7py03nOkqnzYsoT0LgfFZStCHw68+WLjwg@mail.gmail.com>
References: 
 <CAD59NR0X7w6N-8o+rGUPcyH+gbBLc6CGPRVRZy_UsAB73s3tTA@mail.gmail.com>
	<20190723091240.733103de@ncopa-desktop.copa.dup.pw>
	<CAD59NR0z51BV+n3T0NJOdURG6AVu=x0e89eXv8ZZU+-PkcGBMA@mail.gmail.com>
	<CA+cSEmNmtj3m458Gu4ZYh4VwtMFw2xEGq38bs_+vcLosNr2ZRg@mail.gmail.com>
	<CAD59NR2GuL0hAEp70DCf2WvL8zKQKHTGfxoeng4wLE3SB1xNnQ@mail.gmail.com>
	<20190723111532.5a18f982@ncopa-desktop.copa.dup.pw>
	<CAD59NR1rMTYu06Gd4fjxhpPJSYyCwFZv9WDm35MbQxHJN2NqzQ@mail.gmail.com>
	<CAD59NR0KfYZv1=7c7py03nOkqnzYsoT0LgfFZStCHw68+WLjwg@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Hi,

On Sun, 11 Aug 2019 14:29:50 -1000
Teppei Fukuda <knqyf263@gmail.com> wrote:

> Hi Copa,
>=20
> My apologies for keeping asking you questions, but I have one more questi=
on.
>=20
> When I've been following the recent security related commits of
> alpine/aports, I've noticed that you always write secfixes comment
> even if they were not backported fixes. Was this defined as a rule?

No, it was never an expressed or documented rule or request or
anything. The community have just filled in the secfixes data, so it
seems that is the direction things are "naturally" going.

We have recently also moved to gitlab and have tried various ways to
report the issues. Gitlab has made things simpler, for example we are
now using one issue with tasklist of affected branches. We have also
started to add the commit data where the issue is fixed. This seems to
work relatively well and combined with the secfixes data, this is a
good step forward to an advisory program.

> As I mentioned before, I hope that security advisories of Alpine will
> be provided. So I would like to help if I can do anything.

Can you please have a look at the recent security fixes in gitlab and
see what you think, and what we could do differently.
https://gitlab.alpinelinux.org/alpine/aports/issues?scope=3Dall&utf8=3D%E2%=
9C%93&state=3Dclosed&label_name[]=3DSecurity

I specifically wonder how to report multiple CVEs that affect different
branches. See for example
https://gitlab.alpinelinux.org/alpine/aports/issues/10699

Do you think that tracking the security data in secfixes comments in
APKBUILDs and the reported security issues in gitlab is sufficient? We
could probably start also report the issues that we have fixed already,
with the commit with the fix.

>=20
> I know you are so busy. It would be appreciated if I discuss this with
> you when you have time.

Would you like to have a video conference meeting?

-nc

>
>=20
> Best regards,
> Teppei
>=20
> 2019*7*23*(*) 16:56 Teppei Fukuda <knqyf263@gmail.com>:
> >
> > Hi Copa,
> >
> > I appreciate your polite explanation. I understand.
> >
> > Currently, my program collects the following data:
> > 1. the secfixes comments in APKBUILD
> > 2. alpine-secdb (maybe the same as above)
> > 3. the security tickets of Redmine (will be replaced with the
> > issues of GitLab) 4. git diff APKBUILD (only commits related with
> > the above issues)
> >
> > I think we can generate the security advisories by checking all git
> > log like No. 4. For example, the following commit fixes
> > CVE-2019-13636.
> > https://github.com/alpinelinux/aports/pull/9642/files
> >
> > Watching this diff of main/patch/APKBUILD, we can detect the version
> > update from 2.7.6-r4 to 2.7.6-r5. This is my source code doing it.
> > https://github.com/knqyf263/vuln-list-update/blob/d8aefa60155637561a8a2=
d3feb486bbb675c996c/alpine/alpine.go#L404-L450
> >
> > I know this way is not perfect. There may be false
> > positive/negative. However, this process can be automated and the
> > maintenance cost is low. It may be a good way as a first step of
> > the security advisory. It is better if the format of the commit
> > message is fixed. e.g. [os_version] pkgname: fix CVE-ID.
> >
> > I want the security database of Alpine strongly and can help you in
> > the task of investigating it and writing an automation program. But,
> > It is difficult to do manual operation (e.g. I continue to fill the
> > security information manually).
> >
> > Best,
> > Teppei
> >
> > 2019*7*23*(*) 18:18 Natanael Copa <ncopa@alpinelinux.org>: =20
> > >
> > > On Tue, 23 Jul 2019 17:54:40 +0900
> > > Teppei Fukuda <knqyf263@gmail.com> wrote:
> > > =20
> > > > Hi Carlo,
> > > >
> > > > Yes, it is. However, alpine-secdb is database of backported
> > > > fixes as README says. =20
> > > > >It is not a complete database of all security issues in
> > > > >Alpine. =20
> > > >
> > > > I need a complete database of all security issues. =20
> > >
> > > We currently don't have that. I do think we have much or maybe
> > > even most of the needed data, but its spread.
> > >
> > > We need someone who can figure out the pieces that is missing and
> > > find a way to collect and store it in a way that makes it as
> > > simple as possible to fix and roll out fixes.
> > >
> > > We could for example use the secfixes comments in APKBUILD and
> > > data from gitlab issues and generate a database from that, and
> > > have someone fill in the missing data, or we could turn it
> > > around, have someone collect all the data in a database and
> > > generate issues from that and maybe automatically add secfixes
> > > comments from it.
> > >
> > > But we need someone who can investigate and come up with a good
> > > plan.
> > >
> > > -nc =20