3 ms·
At page 3 there is apache2 with more than 300k installs. The maintainer stated no more interest[1]. This seems like low hanging fruit for a massive supply chain
by ogig 6y ago
At page 3 there is apache2 with more than 300k installs. The maintainer stated no more interest[1]. This seems like low hanging fruit for a massive supply chain attack.
[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=910917 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=910917
- iso8859-1 6y agoThat discussion is probably no longer relevant, because you can see on Salsa that people are pushing patches to the packaging: https://salsa.debian.org/apache-team/apache2 https://salsa.debian.org/apache-team/apache2
- vbernat 6y agoThe thread shows how supply chain attacks are difficult with Debian: random people cannot really contribute to something like Apache 2 because they need to be sponsored by a Debian developer and they are being asked to do "boring" stuff before that, like triaging bugs and fixing them. The RFH is mostly here to get more people involved, by the maintenance of Apache2 in Debian is going well and the latest version is currently packaged: https://tracker.debian.org/pkg/apache2 https://tracker.debian.org/pkg/apache2.