Comment 25 for bug 2040137

On Thu, Dec 14, 2023 at 11:15 AM Mark Esler <email address hidden> wrote:
>
> Hi Dann, I have not coordinated yet. The CRD is loose, is there a
> specific date we can commit to? edk2 may have their own timeline, but I
> can reach out for their perspective. January 2nd may be a better date to
> initiate this conversation.

I'd prefer not to commit to a date before upstream is engaged. My
concern is that they may prefer a different approach or spot
additional issues that we should take into account, and that may take
more time. As noted in Comment #16, I'm OK with a date at the end of
January for the edk2 deb part, assuming Mate's approach is the
approach we agree to take. That seems straightforward, other than
removing some shell dependencies from the autopkgtests, which I plan
to spend some time on over the holidays.

> Downstreams and other vendors will be contacted after we have a solid
> patching plan and timeline. So far this includes Debian and (once
> verified) Incus.

Sounds good.

> Seth, does this sound good to you? If so I will file a report on
> https://github.com/tianocore/edk2/security and add you, Dann, and Mate.
> And offer to add their security devs to this bug.

Note that their docs say to file security bugs in their bugzilla
instance, not github:
https://github.com/tianocore/tianocore.github.io/wiki/Reporting-Security-Issues

My bugzilla account there is under <email address hidden>.

   -dann