To find security relevant issues in the package building step, I'm researching and implementing in the (OBS) project level, a way to compile all Factory packages with ASAN without change a single spec. The main goal would be to:

a) automate the compilation with ASAN in OBS b) run the package test suite to try to trigger exceptions c) put it to run in OpenQA