Differences

This shows you the differences between two versions of the page.

--- dev:security [2013/01/17 13:12] – [How are security releases tested?] erickson
+++ dev:security [2023/06/01 13:22] (current) – [How are security fixes released?] master to main dyrcona
@@ Line 1: / Line 1: @@
 =====How the Evergreen Project Handles Security-related Bugs=====
-**This document is a work in progress as of 17-Dec-2012**
 ====How do I report a security-related issue in Evergreen?====
 You can report a security-related issue in Evergreen via the bug tracking system at https://bugs.launchpad.net/evergreen -- be sure to check the box labeled "This bug is a security vulnerability".
+While we prefer that security bugs be reported via Launchpad, they can also be reported to [[mailto:security@evergreen-ils.org|security@evergreen-ils.org]].
 NOTE: If you are an active Evergreen "bug wrangler" or similar, you may instead have an option to change "This bug contains information that is:" from "Public" to "Private Security".
@@ Line 30: / Line 30: @@
 ====How are security fixes released?====
-After testing, the code will be merged to the relevant public Evergreen branches (origin/master, origin/rel_2_3, …) and the Launchpad entries will be marked as Fix Committed.  From here, the release process proceeds the same as a regular non-security release.
+After testing, the code will be merged to the relevant public Evergreen branches (origin/main, origin/rel_2_3, …) and the Launchpad entries will be marked as Fix Committed.  From here, the process proceeds the same as a regular non-security release, though every effort will be made to cut the releases in a timely fashion.
 ====How are security releases announced?====
 Security releases are are announced via the Evergreen blog and via e-mail to the open-ils-general mailing list.
+==== Security team ====
+//This section was proposed on 2015-03-12//
+The purpose of the Evergreen security team is to review reports of
+specific security flaws in Evergreen, to write and test patches to fix
+or ameliorate those flaws, and to perform security releases.
+Membership in the Evergreen security team is available to individuals
+who meet all of the following conditions:
+  - They request membership.
+  -They promise to adhere to the consensus of the security team regarding when to publicly disclose security issues.
+  - They promise to maintain the confidentially of discussions on the open-ils-security mailing list and security bugs on LaunchPad.
+  - They promise to provide assistance to the security team. Such help can take the form of provide substantive commentary on reported security issues, writing patches, testing and reviewing them, writing security documentation, and assisting in the process of preparing and publicizing security releases.
+  - They operate or support the operation of at least one production Evergreen system known to at least one other current member of the security team.
+  - They already have access to various tools required to participating in a meaningful fashion, to wit: a registered account on LaunchPad and at least one public key registered with the Evergreen Git server.
+  - The current members of the security team come to a consensus to admit the new member. The security team reserves the right to reject applications, and will explain their reasoning to the applicant if they should do so.  Applications will be reviewed promptly.
+Membership applications may be made by contacting one of the current
+security team members; a list of the current members' names will be
+maintained on the Evergreen wiki.  [(**Proposed addition, pending approval**) Application for membership should include indication that you have read and agree to the conditions stated above.]
+Violations of the promises in (2) and (3) may result in immediate
+expulsion from the security team.
+Membership in the security team belongs to individuals, not
+institutions.  Membership comes with an expectation that each member
+will actively participate at least part of the time; it is not to be
+treated simply as a means of gaining early access to information about
+security vulnerabilities in Evergreen.
+The team membership list will be reviewed annually; members who have
+not made substantive contributions to the team may be dropped from the
+list, but are free to apply to rejoin.
+Members of the security team will have access to the following
+restricted resources in order to carry out their work:
+  * membership in the private security group on LaunchPad, which will allow them to see and act on bugs that are marked as private security bugs
+  * a subscription and access to the private archives of the open-ils-security mailing list
+  * access to the Git repositories hosting security patches in progress.
+==== Current security team members ====
+  * Thomas Berezansky
+  * Galen Charlton
+  * Jeff Davis
+  * Bill Erickson
+  * Jeff Godin
+  * Rogan Hamby
+  * Kathy Lussier
+  * Mike Rylander
+  * Dan Scott
+  * Chris Sharp
+  * Ben Shum
+  * Jason Stephenson
+  * Yamil Suarez
+  * Dan Wells
+  * Liam Whalen