Open Stack

Now that community PR#39 has merged and
https://github.com/kata-containers/community/blob/master/VMT/VMT.md
officially exists, it would be good to have the Kata Containers
Architecture Committee properly delegate the functions described
there to an initial small team of trusted volunteers from the Kata
Containers community. This delegation should then be followed by
some durable reference publication (perhaps within the above
document) of a list of their names, contact addresses and OpenPGP
public key fingerprints both to act as a fallback reporting channel
in cases where Launchpad bug filing is undesired by the reporter and
also to make it possible for the public at large to verify signed
notices originating from these individuals. A corresponding item has
been added to the 2018-11-05 AC call agenda.

The reason I'm raising this is, in part, because the embargo-notice
ML Anne set up (which is intended for advance distribution of
vulnerability fixes to downstream stakeholders of Kata software) is
still only moderated by OSF staff at the moment. Ideally, the task
of moderating this list would be handed off to the Kata Containers
Vulnerability Management Team so that it serves as a final
cross-check of each others' embargoed pre-KCSA notices to downstream
stakeholders. If the AC wishes I'm willing to also participate as a
list admin/moderator of last resort, in case there are emergency
technical issues with management of the ML itself (as a longstanding
member of the OpenStack project VMT I help run the corresponding
mailing list it uses, so am well-versed in these matters).

It would also be good to ensure that the LP project
https://launchpad.net/katacontainers.io (used both for private
reporting of suspected security vulnerabilities and also formal
requests to become subscribers of the embargo-notice ML) is shared
with the Kata Containers VMT so that they can perform the functions
outlined in their published process. I'm happy to assist the AC with
making those configuration changes if desired.
-- 
Jeremy Stanley
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 963 bytes
Desc: not available
URL: <http://lists.katacontainers.io/pipermail/kata-dev/attachments/20181030/7f4dab11/attachment.sig>