From patchwork Sat Sep 21 14:47:38 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Luca Boccassi X-Patchwork-Id: 59533 Return-Path: X-Original-To: patchwork@dpdk.org Delivered-To: patchwork@dpdk.org Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id EC58D1ED2E; Sat, 21 Sep 2019 16:47:54 +0200 (CEST) Received: from mail-wm1-f68.google.com (mail-wm1-f68.google.com [209.85.128.68]) by dpdk.org (Postfix) with ESMTP id F18DC1BEBB for ; Sat, 21 Sep 2019 16:47:53 +0200 (CEST) Received: by mail-wm1-f68.google.com with SMTP id a6so5324874wma.5 for ; Sat, 21 Sep 2019 07:47:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=jtop+mxnuqShadHtKnblW4siOsp6vvfK4B7G2eOEOB4=; b=LKDiAKT2g6tt/1p2daXYGJKQv04exW6+iRIsR+7ihrbFopY6TcPXm9JW9yi4Qtu5mP 7n7N+XGwOxvBONEWlrT2yXjOKAggwo2A/yo0cnLCiFAmYgytYOzEjf0gi+Bk560PPOuw qviuNeEsFwN+2GMSiV4CCazot80u53ntjjGdO3typZdieXlw0gvU+jkH42yVlhn4I1jg gD/7TjyeO7X6ZdlQhUB4RfChoyy1qcn1WuqpBfCbS2vPsXDNuPvo5Hx+iujmRgIkhPU3 SFMryfqO1KdbrYje6YnKyQsfOSs4OcO5S2XRBCbUO34muaRPsndB4Un1770qS7+dyiN1 i56g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=jtop+mxnuqShadHtKnblW4siOsp6vvfK4B7G2eOEOB4=; b=LcLw5ZP6Cuodst42KjgrWdv936/kKFjYcsYgL42jrJ7v52luUQHlwBZf7WmXb/gXwt f9DGdS5rMIT40qT7g8g0wRgrjyk9OuRuz0sT+5T0ERAvqUmo/iaMlGTzR7BgCUOqFxL1 0IsOJsN6/WJhoc47lMjCotrXzY1AfhIbJwCJHYYShlgerKLNbPd49Yft6QP8doZO83L0 SCxex/my8WJgCSZBUDcGPiLN/xHJFbUwZEQF/9kRYVpIJxczR1hL+rAxRELsCZhbPOai la232zUMbi6AazLbIV3zDhsNqMi6Q0IqXkKal90AdgC03qgjq7B07IMkmw5rrCjxtVLQ POCg== X-Gm-Message-State: APjAAAVSlIIq83Yuv9Tbxix2ZMfHfY/OQmyokH8VXeTIyhyx7rf9kl13 3quoFPXxz6OXck+c0EXZz57G2vlJCOuP9g== X-Google-Smtp-Source: APXvYqy7gfozJUy9q34QD+3jRIMwJjyXBC1Aa0JiFwKZm5DX3IOOYeTKSrg6zr29IzLDR5Z0j2SDPQ== X-Received: by 2002:a1c:c14a:: with SMTP id r71mr7469897wmf.46.1569077273167; Sat, 21 Sep 2019 07:47:53 -0700 (PDT) Received: from localhost ([176.12.107.132]) by smtp.gmail.com with ESMTPSA id b62sm4580360wmc.13.2019.09.21.07.47.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 21 Sep 2019 07:47:52 -0700 (PDT) From: luca.boccassi@gmail.com To: dev@dpdk.org Cc: maxime.coquelin@redhat.com Date: Sat, 21 Sep 2019 16:47:38 +0200 Message-Id: <20190921144738.6962-1-luca.boccassi@gmail.com> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Subject: [dpdk-dev] [PATCH] doc: add oss-security to the security process X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" From: Luca Boccassi The OSS-security project functions as a single point of contact for pre-release, embargoed security notifications. Distributions and major vendors are subscribed to this private list, so that they can be warned in advance and schedule the work required to fix the vulnerability. List and link this process in the DPDK security process document. --- As discussed at Userspace, we should include oss-security in the advanced private notice. This change has a brief explanation and a link to the process. doc/guides/contributing/vulnerability.rst | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/doc/guides/contributing/vulnerability.rst b/doc/guides/contributing/vulnerability.rst index a4bef48576..78f65fe81b 100644 --- a/doc/guides/contributing/vulnerability.rst +++ b/doc/guides/contributing/vulnerability.rst @@ -194,6 +194,14 @@ Downstream stakeholders (in `security-prerelease list * Major DPDK users, considered trustworthy by the technical board, who have made the request to `techboard@dpdk.org `_ +The `OSS security private mailing list mailto:distros@vs.openwall.org>` will +also be contacted one week before the end of the embargo, as indicated by `the +OSS-security process ` +and using the PGP key listed on the same page, describind the details of the +vulnerability and sharing the patch[es]. Distributions and major vendors follow +this private mailing list, and it functions as a single point of contact for +embargoed advance notices for open source projects. + The security advisory will be based on below template, and will be sent signed with a security team's member GPG key. @@ -276,8 +284,9 @@ Releases on Monday to Wednesday are preferred, so that system administrators do not have to deal with security updates over the weekend. The security advisory is posted -to `announce@dpdk.org `_ -as soon as the patches are pushed to the appropriate branches. +to `announce@dpdk.org `_ and to `the public OSS-security +mailing list ` as soon as the patches +are pushed to the appropriate branches. Patches are then sent to `dev@dpdk.org `_ and `stable@dpdk.org `_ accordingly.