Sayun ~ubuntu-security Membership Application

Project Discussion Security
1

Hello everyone!
I am requesting membership to ~ubuntu-security. The information requested in the spec is listed below:




Team Memberships

I am currently a member of the following teams:

  • Canonical - Joined on 2024-03-11
  • Canonical Security Team - Joined on 2024-03-11
  • Ubuntu Security Apprentices - Joined on 2024-04-29
  • SOSS Security Team - Joined on 2024-05-28




Verified Identity

My identity was verified through the general Canonical employee onboarding process, which includes a background check, and verification of my government issued identity documentation.
I have also attended the Canonical Engineering Sprint in May 2024, where during a PGP key signing party, several members of the Ubuntu Security team were able to verify my identity.

My PGP signed “Ubuntu Codes of Conduct” is attached to my Launchpad account, and available here: https://launchpad.net/~sayun/+codesofconduct




History of high-quality sponsored security updates

Listed below is a sampling of USNs that I have published after patching their associated CVEs:


  • Some of these, like the Apache Maven Shared Utils and python-aiohttp, proved to be challenging to test as they involved testing through their respective build systems. Getting to a point where the changes could actually be tested involved going through multiple layers of the build/test process. Debugging the test in python-aiohttp required going into a chroot after a build and running tests from within.
  • The gerbv patch involved working with a file format that I had no prior experience with. Being able to prove the effectiveness of the fix involved learning about the RS-274X and crafting an input that would cause the issue to occur. It was also my first time debugging a GUI application.
  • The ghostscript patches gave me an opportunity to work with QRT. The test involved using QRT to compile a sample C shared object for use in triggering the vulnerability.
  • The Ubuntu Advantage Desktop Daemon update was also a learning experience. This particular package needed to be included in main for versions that would normally be ESM. i.e. In order to get the fix, one needed to go through the process of turning on Ubuntu Pro, which would have been a vulnerable code path without the fix already in place. Putting the patched version in main would allow this to be mitigated prior to turning on Ubuntu Pro.




Demonstrated understanding of required tools and systems

I have worked with UCT and QRT as a part of my CVE patching process, example merge requests are listed below:

https://code.launchpad.net/~sayun/ubuntu-cve-tracker/+git/UCT/+merge/467643
https://code.launchpad.net/~sayun/ubuntu-cve-tracker/+git/UCT/+merge/472712

https://code.launchpad.net/~sayun/qa-regression-testing/+git/qa-regression-testing/+merge/468446
https://code.launchpad.net/~sayun/qa-regression-testing/+git/qa-regression-testing/+merge/463639




Additionally, I am making continued contributions in documentation and process improvements. I have made dozens of edits to the Ubuntu Wiki, especially around the process of creating build environments.


Thank you!

1 Like
2

+1 from me as @sayun has clearly met each requirement to join ~ubuntu-security and has done some great work with all contributions!

1 Like
3

@sayun has met all the criteria to join ~ubuntu-security and consistently produced outstanding work with each contribution. +1 from me!

1 Like
4

@sayun is a solid contributor to the team. He is very proactive and has all the requirements to become a member. +1 for sure from me.

1 Like
5

+1 from me as well to support @sayun application to ~ubuntu-security. The evidence he is providing clearly demonstrates he is meeting the expected requirements meanwhile contributing with excellence to the Ubuntu Security. Thanks for doing such great work!

1 Like
6

+1 from me on granting membership to the lp:~ubuntu-security to @sayun ; he has approached the update process with great care, is comfortable asking questions when coming across issues he has not seen before, and has seen different aspects and quirks with each update that he has done. Great work!

1 Like
7

+1 from me as @sayun has shown a excellent work and for sure met the requirements to join ~ubuntu-security!

1 Like
8

+1 on granting @sayun membership!

1 Like
9

+1 to add @sayun to ~ubuntu-security.
Thanks for doing an awesome job.

1 Like
10

Thank you @sayun for your application, and thank you to everyone who gave feedback on the application. Voting is now closed.

The following votes were cast by existing Ubuntu Security members:

The application is approved with a balance of 8 affirmative votes making up 100% of the total votes cast.

Congratulations and welcome Chris Kim! I have added you to the Ubuntu Security team, please exercise caution with your new rights.

Thanks,
Steve Beattie