Hello, many packages in tree are masked due to security issues instead of issuing GLSA for them. Why? At this moment I counted 56 such packages in package.mask.
Some of these packages have GLSAs issued (e.g. nethack and friends) and have no fixes, so this is understandable. But most packages are just masked "due to security bugs", I recently stumbled upon: ppp, mariadb, mysql, vlc... Why such masking is bad? Because it undermines the whole idea of GLSA as a sole security provider for Gentoo users. I manage about 50 Gentoo boxes (with more than 10 unique setups) and I'm not an update monkey to update them weekly. My usual workflow is to emerge all world somewhere within 6 month and 1 year, but to install security updates regularly and critical ones ASAP. GLSA serves this purpose well (Yes, I understood that security team can't embrace all issues so some extra lookup for CVEs is needed as well). But security-masked packages undermine such approach, because they're not listed in glsa-check -l affected and message about masked packages doesn't appear in elog, only on top of build log, which is likely to be lost. Best regards, Andrew Savchenko
pgpEx0TUSKfth.pgp
Description: PGP signature
