security discussion 14:00UTC today

[Jonathan Riddell]

Meeting had:
- I discussed how Aptly was moved to a new server with incomplete
setup for logging and listening globally for uploads
- logging and listening only to localhost now fixed
- builds wiped and all redone, communication was considered to be well managed
- IaC Infrastructure as Code should be embraced even if Chef can't be
used (we have no root access to the new server). e.g
https://github.com/apachelogger/neon-contents-grapple/blob/master/deploy.rb
- security layer of security should be added - gpg signing packages
for upload to Aptly
- reproducible builds might help to verify but no sign of them happening yet
- peer review of IaC code should be done




On 23 November 2016 at 10:45, Jonathan Riddell <jr at jriddell.org> wrote:
> We'll have a chat about the security issue in #kde-neon at 14:00UTC
> today, all welcome