No video of the event yet, sorry!

The SUSE security team often finds security issues specific to the rpm packaging of applications. This talk show you some of the findings and will give you recommendations on how to avoid creating CVEs while packaging software.

This will be interesting to you if you're a packager and use %post or similar scriptlets in your packaging. Unfortunately it's quite easy to cause security issues while using these. But most packagers are not aware of the risk. This talk is intended to change that and give you the knowledge on how to prevent issues like these.

Modern rpm versions already have some limited counter measures against some of the issues that will be shown, but we can't rely on them to fix all of the usual problem that we see when reviewing these constructs.