news
Glibc project revisits infrastructure security
The GNU C Library (glibc) is the core C library for most Linux distributions, so it is a crucial part of the open-source ecosystem—and an attractive target for any attackers looking to carry out supply-chain attacks. With that being the case, securing the project's infrastructure using industry best practices and improving the security of its development practices are a frequent topic among glibc developers. A recent discussion suggests that improvements are not happening as quickly as some would like.
On May 9, glibc maintainer Carlos O'Donell wrote to the libc-alpha mailing list to ask other glibc developers to review a secure software development life-cycle process document that he had drafted for glibc. He also provided a similar top-level document for the GNU toolchain that includes GNU Binutils, GCC, glibc, and the GNU Project Debugger (GDB). The goal is to define ""what we expect from the infrastructure, developer end points, and our process"" in order to figure out what services are needed to create a more secure development process.
The glibc project is hosted on Sourceware, which provides project hosting for free-software toolchain and developer tools, including those that comprise the GNU Toolchain. O'Donell noted that some of the items in his document were taken from Sourceware Cyber Security FAQ in its section "suggested secure development policies for projects", but had been rearranged into a structure that matched the NIST Secure Software Development Framework, which is the standard he recommended as ""the simplest and least prescriptive"".