Re: Announcing https://github.com/RedHatProductSecurity/Certificates-Shipped/

[Kurt Seifried <kseifried () redhat com>]

On Wed, Nov 25, 2015 at 2:21 PM, Gsunde Orangen <gsunde.orangen () gmail com>
wrote:

> Totally reasonable, Kurt.
> Where would you actually see the border between what's in and what's
> out? Actually there are lots of (proprietary source) vendor products out
> there that are heavily built on open source (e.g. virtually all linux
> kernel based embedded devices)
> Not saying someone should go through the hassles to chase for it - but
> if the info is brought to you/to the repository...
So in short: only stuff that is Open Source licensed. Definitely things
that are fully Open Sourced (e.g. upstream project, or distributions like
Red Hat or Debian). If a proprietary vendor uses some OpenSource bits then
I'd be interested if the upstream project also ships it, so it would go
under that upstream listing. If it's stuff the proprietary vendors are
adding I'm not really interested, for two reasons:

1) proprietary/closed source vendors have a long history of doing silly
things, so it's a given they'll have problems here
2) the chances of getting them to fix it are low, so I'm simply not
interested in spending any time/resources on it.

If you want to create a project in GitHub that covers OpenSource bits used
in mostly proprietary vendors (e.g. Mac OS X) then feel free to, but again
for  a multitude of reasons I'm not interested in that side of the problem.



> Gsunde


Also as an example of what I am looking for I did an initial dump of Fedora
23 (all of it) we end up with about 83 packages containing certs/keys/etc.
Some are obvious (archlinux-keyring, debian-keyring, ca-certificates,
bind), some are embedded (mostly copies of the Mozilla CA cert stuff) and
some need more research. If anyone wants to add notes/data to them please
feel free.

https://github.com/RedHatProductSecurity/Certificates-Shipped/tree/master/distributions/Fedora/23


--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert () redhat com