Clarification on embargoed testing in a partner cloud

[Marc Deslauriers <marc.deslauriers () canonical com>]

Hi,

The Ubuntu security team shares and obtains information about embargoed issues 
from the distros and linux-distros mailing lists.

One of our large cloud partners has asked the Ubuntu security team to do 
automated testing of embargoed security updates on their public cloud before the 
CRD. While technically we would not be directly sharing details of embargoed 
issues with them as the tests will be run under accounts owned by the Ubuntu 
security team, they will be run on their infrastructure. As such, this may 
hinder our ability to conduct a comprehensive internal investigation of any leak 
that may occur.

I’m not exactly sure how this scenario fits within the policy of these lists, 
and would like to validate before we go ahead. ( Policy can be found here: 
https://oss-security.openwall.org/wiki/mailing-lists/distros )

Would testing embargoed updates obtained from the distros and linux-distros 
lists on an external cloud infrastructure violate the terms of those mailing 
lists? Would testing embargoed updates on an external cloud infrastructure be 
contrary to the expectations of the vendors posting embargoed issues to those lists?

Thanks,

Marc.

--
Marc Deslauriers
Ubuntu Security Engineer     | http://www.ubuntu.com/
Canonical Ltd.               | http://www.canonical.com/