d/numam-dpdk
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

doc: add oss-security to the security process

Browse Source 
The OSS-security project functions as a single point of contact for
pre-release, embargoed security notifications. Distributions and major
vendors are subscribed to this private list, so that they can be warned
in advance and schedule the work required to fix the vulnerability.

List and link this process in the DPDK security process document.

Signed-off-by: Luca Boccassi <luca.boccassi@microsoft.com>
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
This commit is contained in:
Luca Boccassi 2019-09-21 16:52:42 +02:00 committed by David Marchand
parent 18562261ab
commit a46987cf94
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
doc/guides/contributing/vulnerability.rst
View File

@ -194,6 +194,14 @@ Downstream stakeholders (in `security-prerelease list
* Major DPDK users, considered trustworthy by the technical board, who
have made the request to `techboard@dpdk.org <mailto:techboard@dpdk.org>`_
The `OSS security private mailing list mailto:distros@vs.openwall.org>` will
also be contacted one week before the end of the embargo, as indicated by `the
OSS-security process <https://oss-security.openwall.org/wiki/mailing-lists/distros>`
and using the PGP key listed on the same page, describing the details of the
vulnerability and sharing the patch[es]. Distributions and major vendors follow
this private mailing list, and it functions as a single point of contact for
embargoed advance notices for open source projects.
The security advisory will be based on below template,
and will be sent signed with a security team's member GPG key.
@ -276,8 +284,9 @@ Releases on Monday to Wednesday are preferred, so that system administrators
do not have to deal with security updates over the weekend.
The security advisory is posted
to `announce@dpdk.org <mailto:announce@dpdk.org>`_
as soon as the patches are pushed to the appropriate branches.
to `announce@dpdk.org <mailto:announce@dpdk.org>`_ and to `the public OSS-security
mailing list <mailto:oss-security@lists.openwall.com>` as soon as the patches
are pushed to the appropriate branches.
Patches are then sent to `dev@dpdk.org <mailto:dev@dpdk.org>`_
and `stable@dpdk.org <mailto:stable@dpdk.org>`_ accordingly.