Existing shim reviews and the 15.8 release

[jason-rodri]

I have a question concerning organizations who have outstanding 15.7 shim reviews and how we should approach the 15.8 shim release.

Should we update our existing 15.7 reviews with the 15.8 release or should we create an additional review for the 15.8 release?

With the 15.8 release now public will an existing 15.7 shim review be approved?

[kukrimate]

15.8 fixes security issues, no more 15.7 shims should be signed.

[enriched]

@kukrimate thank you for clarifying that. Do you know if updating the current review would be acceptable, or are people typically asked to create a new review?

[SherifNagy]

I would say opening a new submission will make everyone's life easier, but that's my personal preference

[jsetje]

I'd like to propose that all 15.7 based submissions be closed asking for a 15.8 based one. One of the CVEs addressed in 15.8 has a disturbingly high score and I could see revocations for 15.7 becoming mandatory at some point the future, potentially without much advance notice.

[THS-on]

@jsetje now went through the submissions asking people either to update or create new ones.

If they don't respond in a timely fashion, I'll close them.

[THS-on]

everybody seems now to have responded to the updating requests, therefore closing this one