Core Toolchain Infrastructure - Update on glibc service SOW

[Zack Weinberg]

On Mon, Jul 8, 2024, at 3:47 PM, Joseph Myers wrote:
> * Simply having lots of projects in one Sourceware Bugzilla, instead
>   of lots of separate Bugzilla instances for separate projects (each
>   of which has no special access to any of the others - in VMs or
>   containers or failing that at least all running as separate users,
>   though as above I think protection from multiple user accounts is
>   limited), itself involves an undesirable risk of a compromise
>   spreading further than necessary.

Hmm, this specific bit of proposed hardening is in direct conflict with
desirable functionality for both users and maintainers: having only one
Bugzilla instance for the entire toolchain means that bugs can be
reassigned between "products" as necessary, bugs in one "product" can be
a dependency of bugs in other "products", individual bugs can be easily
monitored by more than one project's release managers, and, last but not
least, people only need one user account to report a bug against any
piece of the toolchain.  From this perspective it would actually make
sense to *combine* gcc.gnu.org/bugzilla with sourceware.org/bugzilla.

zw