When synching via emerge-webrsync, the snapshots don't include the latest GLSA. Latest included is from about 2 weeks ago. Reproducible: Always Steps to Reproduce: 1. emerge-webrsync 2. ls -l /usr/portage/metadata/glsa/glsa-20221* 3. # compare with https://security.gentoo.org/glsa
The last batch of GLSAs was released several weeks ago and the latest batch will be in todays snapshot just made.
I'm clearly out of my depth here, sorry. If the portage snapshots are made daily, why aren't all the existing GLSAs included? Doesn't this mean that those that can't --sync (eg: behind firewall) can be weeks behind the security alerts?
(In reply to Paulo M from comment #2) > I'm clearly out of my depth here, sorry. > > If the portage snapshots are made daily, why aren't all the existing GLSAs > included? Doesn't this mean that those that can't --sync (eg: behind > firewall) can be weeks behind the security alerts? There were no new GLSAs until yesterday anyway and then when you pulled the snapshot, you did it just before it would've included the latest ones released y'day. i.e. the snapshot is only ever delayed by at most 24 hours (supposing we release GLSAs _right_ after midnight or bang-on after it starts generating).
Looks like yesterday's snapshot has all of yesterday's GLSAs, so works for me?
(In reply to Sam James from comment #3) > (In reply to Paulo M from comment #2) > > I'm clearly out of my depth here, sorry. > > > > If the portage snapshots are made daily, why aren't all the existing GLSAs > > included? Doesn't this mean that those that can't --sync (eg: behind > > firewall) can be weeks behind the security alerts? > > There were no new GLSAs until yesterday anyway and then when you pulled the > snapshot, you did it just before it would've included the latest ones > released y'day. > > i.e. the snapshot is only ever delayed by at most 24 hours (supposing we > release GLSAs _right_ after midnight or bang-on after it starts generating). I get the up to 24h delay. What I hadn't realized is that the GLSAs are released in batches — that confused me since the difference between a rsync and a websync systems were dozens of GLSAs with the latest being already ~2 weeks old on the websync one, which made me think they weren't in sync for a while. Are these batches of GLSAs just side effect from other vendors reports/timeline, or is it a gentoo policy?
I think maybe misinterpreting "batches". We tend to write them (it's manual) and release them when we have time. there's no formal schedule, we just write and release them as soon as we can, and within the last few weeks there weren't any ready to go (either no vulnerabilities, no ebuilds ready yet, advisories not yet ready, ...)
