CRA compliance

CRA compliance

[Arisu Tachibana]

Hello everyone,

as per the discussion of last week,
for moving on with the CRA compliance topic.
I propose to create a private mailing-list called
security@kernelci.org or security-kernelci@lists.linux.dev

any objection ? or suggestion?

-- 
thanks,
arisut

Re: CRA compliance

[Greg KH]

On Thu, Oct 09, 2025 at 07:43:08PM +0900, Arisu Tachibana wrote:
> Hello everyone,
> 
> as per the discussion of last week,
> for moving on with the CRA compliance topic.
> I propose to create a private mailing-list called
> security@kernelci.org or security-kernelci@lists.linux.dev
> 
> any objection ? or suggestion?

Why is this needed?  Kernel.ci isn't going to be a "steward" of anything
used in a commercial offering, is it?  If not, what would it be for?

thanks,

greg k-h

Re: CRA compliance

[Gustavo Padovan]

Hi Greg,

---- On Thu, 09 Oct 2025 07:48:45 -0300 Greg KH <gregkh@linuxfoundation.org> wrote ---

 > On Thu, Oct 09, 2025 at 07:43:08PM +0900, Arisu Tachibana wrote: 
 > > Hello everyone, 
 > > 
 > > as per the discussion of last week, 
 > > for moving on with the CRA compliance topic. 
 > > I propose to create a private mailing-list called 
 > > security@kernelci.org or security-kernelci@lists.linux.dev 
 > > 
 > > any objection ? or suggestion? 
 >  
 > Why is this needed?  Kernel.ci isn't going to be a "steward" of anything 
 > used in a commercial offering, is it?  If not, what would it be for? 

Indeed. Although KernelCI offer free testing services to the community, we are not offering any
products or commercial engagements. So we don't need CRA per se.  However, on a related front
we are working with LF Legal to protect the testing services surfaces as stuff that KernelCI creates
gets to run in internal networks across the industry.

Then for security breaches in KernelCI, it would be a best practice to create kernelci-security@
mailing list for people to report issues and for us to community privately with parties running 
KernelCI infra too.

Best,

- Gus

Re: CRA compliance

[Greg KH]

On Thu, Oct 09, 2025 at 09:51:44AM -0300, Gustavo Padovan wrote:
> Hi Greg,
> 
> ---- On Thu, 09 Oct 2025 07:48:45 -0300 Greg KH <gregkh@linuxfoundation.org> wrote ---
> 
>  > On Thu, Oct 09, 2025 at 07:43:08PM +0900, Arisu Tachibana wrote: 
>  > > Hello everyone, 
>  > > 
>  > > as per the discussion of last week, 
>  > > for moving on with the CRA compliance topic. 
>  > > I propose to create a private mailing-list called 
>  > > security@kernelci.org or security-kernelci@lists.linux.dev 
>  > > 
>  > > any objection ? or suggestion? 
>  >  
>  > Why is this needed?  Kernel.ci isn't going to be a "steward" of anything 
>  > used in a commercial offering, is it?  If not, what would it be for? 
> 
> Indeed. Although KernelCI offer free testing services to the community, we are not offering any
> products or commercial engagements. So we don't need CRA per se.  However, on a related front
> we are working with LF Legal to protect the testing services surfaces as stuff that KernelCI creates
> gets to run in internal networks across the industry.

That's great, but that has nothing to do with the CRA :)

> Then for security breaches in KernelCI, it would be a best practice to create kernelci-security@
> mailing list for people to report issues and for us to community privately with parties running 
> KernelCI infra too.

"communicate privately" == "private communication channels" which opens
up a TON of legal issues, as I am want to talk at length with :)

Be VERY VERY VERY careful with this, there's a whole boatload of
problems that you can get into when doing this as you are taking a
public project's communications private to specific companies/entities.

Anyway, having a security@ address is great to REPORT bugs to, but
please refrain from using that to attempt to coordinate security fix
rollouts.  That way lies a death by a thousand paper cuts and
potentially talking to government entities when you least expect it.

I can go into much more detail if people really want.

thanks,

greg k-h

Re: CRA compliance

[Arisu Tachibana]

On Thu, Oct 9, 2025 at 10:06 PM Greg KH <gregkh@linuxfoundation.org> wrote:
>
> On Thu, Oct 09, 2025 at 09:51:44AM -0300, Gustavo Padovan wrote:
> > Hi Greg,
> >
> > ---- On Thu, 09 Oct 2025 07:48:45 -0300 Greg KH <gregkh@linuxfoundation.org> wrote ---
> >
> >  > On Thu, Oct 09, 2025 at 07:43:08PM +0900, Arisu Tachibana wrote:
> >  > > Hello everyone,
> >  > >
> >  > > as per the discussion of last week,
> >  > > for moving on with the CRA compliance topic.
> >  > > I propose to create a private mailing-list called
> >  > > security@kernelci.org or security-kernelci@lists.linux.dev
> >  > >
> >  > > any objection ? or suggestion?
> >  >
> >  > Why is this needed?  Kernel.ci isn't going to be a "steward" of anything
> >  > used in a commercial offering, is it?  If not, what would it be for?
> >
> > Indeed. Although KernelCI offer free testing services to the community, we are not offering any
> > products or commercial engagements. So we don't need CRA per se.  However, on a related front
> > we are working with LF Legal to protect the testing services surfaces as stuff that KernelCI creates
> > gets to run in internal networks across the industry.
>
> That's great, but that has nothing to do with the CRA :)

right, that was my misunderstanding.
thanks for pointing it out :)

>
> > Then for security breaches in KernelCI, it would be a best practice to create kernelci-security@
> > mailing list for people to report issues and for us to community privately with parties running
> > KernelCI infra too.
>
> "communicate privately" == "private communication channels" which opens
> up a TON of legal issues, as I am want to talk at length with :)
>
> Be VERY VERY VERY careful with this, there's a whole boatload of
> problems that you can get into when doing this as you are taking a
> public project's communications private to specific companies/entities.
>
> Anyway, having a security@ address is great to REPORT bugs to, but
> please refrain from using that to attempt to coordinate security fix
> rollouts.  That way lies a death by a thousand paper cuts and
> potentially talking to government entities when you least expect it.
>
> I can go into much more detail if people really want.
>

Would be nice to have more detail on this topic in the future.

-- 
thanks,
arisut

Re: CRA compliance

[Greg KH]

On Thu, Oct 09, 2025 at 10:58:18PM +0900, Arisu Tachibana wrote:
> On Thu, Oct 9, 2025 at 10:06 PM Greg KH <gregkh@linuxfoundation.org> wrote:
> > > Then for security breaches in KernelCI, it would be a best practice to create kernelci-security@
> > > mailing list for people to report issues and for us to community privately with parties running
> > > KernelCI infra too.
> >
> > "communicate privately" == "private communication channels" which opens
> > up a TON of legal issues, as I am want to talk at length with :)
> >
> > Be VERY VERY VERY careful with this, there's a whole boatload of
> > problems that you can get into when doing this as you are taking a
> > public project's communications private to specific companies/entities.
> >
> > Anyway, having a security@ address is great to REPORT bugs to, but
> > please refrain from using that to attempt to coordinate security fix
> > rollouts.  That way lies a death by a thousand paper cuts and
> > potentially talking to government entities when you least expect it.
> >
> > I can go into much more detail if people really want.
> >
> 
> Would be nice to have more detail on this topic in the future.

See my 2023 Kernel Recipies talk:
	https://www.youtube.com/watch?v=2TZe5EROFhE
around the 22:30 minute mark for more details.

thanks,

greg k-h

Re: CRA compliance

[Gustavo Padovan]

---- On Thu, 09 Oct 2025 10:06:42 -0300 Greg KH <gregkh@linuxfoundation.org> wrote ---

 > On Thu, Oct 09, 2025 at 09:51:44AM -0300, Gustavo Padovan wrote: 
 > > Hi Greg, 
 > > 
 > > ---- On Thu, 09 Oct 2025 07:48:45 -0300 Greg KH <gregkh@linuxfoundation.org> wrote --- 
 > > 
 > >  > On Thu, Oct 09, 2025 at 07:43:08PM +0900, Arisu Tachibana wrote: 
 > >  > > Hello everyone, 
 > >  > > 
 > >  > > as per the discussion of last week, 
 > >  > > for moving on with the CRA compliance topic. 
 > >  > > I propose to create a private mailing-list called 
 > >  > > security@kernelci.org or security-kernelci@lists.linux.dev 
 > >  > > 
 > >  > > any objection ? or suggestion? 
 > >  > 
 > >  > Why is this needed?  Kernel.ci isn't going to be a "steward" of anything 
 > >  > used in a commercial offering, is it?  If not, what would it be for? 
 > > 
 > > Indeed. Although KernelCI offer free testing services to the community, we are not offering any 
 > > products or commercial engagements. So we don't need CRA per se.  However, on a related front 
 > > we are working with LF Legal to protect the testing services surfaces as stuff that KernelCI creates 
 > > gets to run in internal networks across the industry. 
 >  
 > That's great, but that has nothing to do with the CRA :) 

FWIW, I just pushed a PR adding some remarks about reporting security vulnerabilities to KernelCI:

https://github.com/kernelci/kernelci-project/pull/553

Best,

- Gus