16:33 <tyhicks> #startmeeting
16:33 <meetingology> Meeting started Mon Apr 27 16:33:24 2015 UTC.  The chair is tyhicks. Information about MeetBot at http://wiki.ubuntu.com/meetingology.
16:33 <meetingology> 
16:33 <meetingology> Available commands: action commands idea info link nick
16:33 <tyhicks> The meeting agenda can be found at:
16:33 <tyhicks> [LINK] https://wiki.ubuntu.com/SecurityTeam/Meeting
16:33 <tyhicks> [TOPIC] Announcements
16:34 <tyhicks> Thanks to Rhonda D'Vine (rhonda) for help on security updates for the community supported wesnoth-1.10 last week. Your work is very much appreciated and will keep Ubuntu users secure. Great job! :)
16:34 <tyhicks> (LP: #1445688)
16:34 <ubottu> Launchpad bug 1445688 in wesnoth-1.10 (Ubuntu Utopic) "private file disclosure issue (CVE-2015-0844)" [Undecided,Fix released] https://launchpad.net/bugs/1445688
16:34 <tyhicks> [TOPIC] Weekly stand-up report
16:35 <tyhicks> jdstrand is busy atm so we'll skip him for now
16:35 <tyhicks> he can jump in if he frees up
16:35 <tyhicks> mdeslaur: go ahead
16:35 <mdeslaur> I'm on community this week
16:35 <mdeslaur> Im currently sponsoring ffmpeg
16:35 <mdeslaur> tomorrow I have patch piloting duties
16:35 <mdeslaur> I just published a few updates, and I have a couple more to test
16:36 <mdeslaur> and I completely forgot about the openssl precise update that I started, which I'll look into again
16:36 <mdeslaur> that's about it form me, sbeattie?
16:36 <essembe> I'm on bug triage this week
16:36 <mdeslaur> essembe: INTRUDER!
16:36 <tyhicks> who's this guy
16:36 <essembe> oh bah
16:36 <sarnold> he looks shifty
16:36 <sbeattie> I'm on bug triage this week
16:37 <sbeattie> I'm finishing up preparing the trusty apparmor SRU, I just have a couple of snags I hit to smooth out.
16:38 <sbeattie> And then I'll switch to focusing on the gcc-pie work
16:38 <sbeattie> I need to look at tyhicks patchset to support systemd, so we can land that work when W opens
16:38 <sbeattie> that's pretty much it for me. tyhicks?
16:39 <tyhicks> mdeslaur: back to your openssl precise update - is that to enable tlsv1.2 by default for clients?
16:41 <tyhicks> I'm on CVE triage this week
16:41 <tyhicks> I have a short week and will be off Thursday and Friday
16:41 <tyhicks> I need to circle back to a number of things that were ignored during the ramp up to the Vivid release
16:42 <tyhicks> and I want to finish the kernel patches for AppArmor kernel keyring mediation
16:42 <tyhicks> it would be nice if I could get those patches out for review before Thursday but I'm not sure
16:42 <tyhicks> jjohansen: you're up
16:42 <mdeslaur> tyhicks: yes, that's it
16:42 <tyhicks> thanks
16:42 <jjohansen> I have a short week this week, I will be off Friday
16:43 <jjohansen> I have a couple backported CVE kernel fixes to look at and discuss with the kernel team
16:44 <jjohansen> I also have a couple more apparmor patches to get out to the kernel team, so we can get the fixes into the next round of kernels
16:44 <jjohansen> bug #1430546
16:44 <ubottu> bug 1430546 in linux (Ubuntu) "apparmor kernel BUG kills firefox" [Medium,Triaged] https://launchpad.net/bugs/1430546
16:45 <jjohansen> being one of them (sorry I seem to have lost my browser tabs)
16:46 <tyhicks> no problem
16:46 <jjohansen> and then its back to the apparmor upstream cleanup. I plan to finish up with the domain transition cleanup/fixes this week (not that I didn't plan on finishing that bit last week :/)
16:47 <jjohansen> I think that is it from me sarnold you're up
16:47 <tyhicks> jjohansen: I noticed that a new AA kernel bug came in (LP: #1448912)
16:47 <ubottu> Launchpad bug 1448912 in AppArmor "BUG: unable to handle kernel NULL pointer dereference" [Undecided,New] https://launchpad.net/bugs/1448912
16:48 <jjohansen> tyhicks: oh I hadn't noticed that one, yet. I'll poke at that one too, this week
16:48 <tyhicks> thanks
16:49 <tyhicks> sarnold: go ahead :)
16:49 <sarnold> I'm in the happy place this week; I will be working more on openstack updates, and getting the hang of how the different openstack services work, etc.
16:50 <mdeslaur> sarnold: FYI, I think the updates in the ppa are now out of date, more CVEs came out in the meantime
16:50 <sarnold> I think I'll poke at the horizon service this week, and try to reproduce one of the issues on serverstack and try to find out if th e issue affects precise or not, and I'd love love love to get an update out the door, but .. thursdays always come so quickly
16:51 <sarnold> mdeslaur: yes, I think most of those updates are now stale :(
16:51 <tyhicks> getting an update out this week would be great since you're in the happy place
16:51 <tyhicks> it is always a little more difficult on cve triage weeks
16:51 <sarnold> yes
16:51 <sarnold> so very much yes :)
16:51 <tyhicks> sarnold: do you plan on updating the packages with the new fixes?
16:52 <sarnold> tyhicks: I can give it  ashot, I haven't actually looked into the details of any of the fixed packages in the ppa, excepting the one horizon issue
16:52 <sarnold> .. nor the details of the subsequently discovered CVEs
16:52 <tyhicks> sarnold: ok, we'll discuss it more in a little bit
16:53 <sarnold> I may also do some apparmor patch reviews for distraction along the way
16:53 <sarnold> that's me, chrisccoulson?
16:53 <chrisccoulson> This week, I need to get chromium out
16:53 <chrisccoulson> I'll also be working through code reviews (my queue is quite large now)
16:54 <chrisccoulson> And I'm currently looking at a browser crash on the phone
16:54 <chrisccoulson> Other than that, it's business as usual (hopefully)
16:55 <tyhicks> thanks
16:55 <tyhicks> [TOPIC] Highlighted packages
16:56 <tyhicks> The Ubuntu Security team will highlight some community-supported packages that might be good candidates for updating and or triaging. If you would like to help Ubuntu and not sure where to start, this is a great way to do so.
16:56 <tyhicks> See https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures for details and if you have any questions, feel free to ask in #ubuntu-security. To find out other ways of helping out, please see https://wiki.ubuntu.com/SecurityTeam/GettingInvolved.
16:56 <tyhicks> http://people.canonical.com/~ubuntu-security/cve/pkg/mednafen.html
16:56 <tyhicks> http://people.canonical.com/~ubuntu-security/cve/pkg/prewikka.html
16:56 <tyhicks> http://people.canonical.com/~ubuntu-security/cve/pkg/rt-authen-externalauth.html
16:56 <tyhicks> http://people.canonical.com/~ubuntu-security/cve/pkg/forked-daapd.html
16:56 <tyhicks> http://people.canonical.com/~ubuntu-security/cve/pkg/mc.html
16:56 <tyhicks> [TOPIC] Miscellaneous and Questions
16:56 <tyhicks> Does anyone have any other questions or items to discuss?
16:58 <tyhicks> mdeslaur, sbeattie, jjohansen, sarnold, ChrisCoulson: Thanks!
16:58 <tyhicks> #endmeeting