Skip to content

Create SECURITY.md#1318

Merged
joelit merged 3 commits intomasterfrom
issue1292-security-policy
May 4, 2022
Merged

Create SECURITY.md#1318
joelit merged 3 commits intomasterfrom
issue1292-security-policy

Conversation

@joelit
Copy link
Contributor

@joelit joelit commented May 3, 2022 •
edited
Loading

Reasons for creating this PR

Skosmos repository was missing a security policy file from its community guidelines.

Link to relevant issue(s), if any

Description of the changes in this PR

Known problems or uncertainties in this PR

We need to discuss which versions we are supporting with security patches. Release documentation needs to include updating the security policy file.

Checklist

  • phpUnit tests pass locally with my changes
  • I have added tests that prove my fix is effective or that my feature works (if not, explain why below)
  • The PR doesn't introduce unintended code changes (e.g. empty lines or useless reindentation)

@joelit joelit added the maintenance Dependency changes, security updates, infrastructure tweaks & general mainenance label May 3, 2022
@joelit joelit added this to the 2.15 milestone May 3, 2022
@joelit joelit self-assigned this May 3, 2022
@codecov
Copy link

codecov bot commented May 3, 2022 •
edited
Loading

Codecov Report

Merging #1318 (69c2aa1) into master (a54f285) will not change coverage.
The diff coverage is n/a.

@@            Coverage Diff            @@
##             master    #1318   +/-   ##
=========================================
  Coverage     70.36%   70.36%           
  Complexity     1649     1649           
=========================================
  Files            32       32           
  Lines          3790     3790           
=========================================
  Hits           2667     2667           
  Misses         1123     1123

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update a54f285...69c2aa1. Read the comment docs.

kinow
kinow approved these changes May 3, 2022
View reviewed changes
Copy link
Collaborator

@kinow kinow left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎉

Probably good to update the release checklist with a note to check the versions in this doc.

Thanks!!!

@osma
Copy link
Member

osma commented May 3, 2022

I wonder if we could make use of the newly published RFC 9116 which defines a machine- and human-readable security.txt file format: https://www.rfc-editor.org/rfc/rfc9116 Or is that perhaps overkill?

Ping @kinow , what do you think as the original proposer of this?

@kinow
Copy link
Collaborator

kinow commented May 4, 2022 •
edited
Loading

I wonder if we could make use of the newly published RFC 9116 which defines a machine- and human-readable security.txt file format: https://www.rfc-editor.org/rfc/rfc9116 Or is that perhaps overkill?

Ping @kinow , what do you think as the original proposer of this?

I didn't know about this RFC @osma, thanks!

Had a look at the specification, and looks like it'd something to have deployed to Finto, for instance, similar to the robots.txt file.

I think SECURITY.md is intended for developers and end-users to learn how to report. And while security.txt can also be used for that, it was created to contain a format with specific fields so that it can be parsed by machines too. From the spec:

This document defines a machine-parsable format ("security.txt") to help organizations describe their vulnerability disclosure practices to make it easier for researchers to report vulnerabilities.

p.s interesting that I can see a security.txt for Google, GitHub, Snyk but OWASP is 404'ing 😅

osma
osma reviewed May 4, 2022
View reviewed changes
kinow
kinow approved these changes May 4, 2022
View reviewed changes
Copy link
Collaborator

@kinow kinow left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Easier! No need to add one more item to the release process, good idea!

@joelit
Copy link
Contributor Author

joelit commented May 4, 2022

So, this is how the latest iteration would look - less upkeep with no version numbers.

Screenshot from 2022-05-04 11-04-31

osma
osma reviewed May 4, 2022
View reviewed changes
SECURITY.md Outdated

## Supported Versions

Following Skosmos versions are currently being supported with security updates. The "current development branch" means the master branch of the repository, whereas the "maintenance branch" corresponds with the latest release of Skosmos.
Copy link
Member

@osma osma May 4, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"currently being supported with security updates" - this doesn't say who is responsible. Could we say:

currently being supported with security updates by the Skosmos development team at the National Library of Finland.

Minor grammar correction: "corresponds with" -> "corresponds to"

To be a bit more explicit about branches, could we express it like this:

whereas the "maintenance branch" is a branch called vX.X-maintenance, where the version number X.X corresponds to the latest release of Skosmos.

@sonarqubecloud
Copy link

sonarqubecloud bot commented May 4, 2022

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
No Duplication information No Duplication information

osma
osma approved these changes May 4, 2022
View reviewed changes
Copy link
Member

@osma osma left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@joelit joelit merged commit 566ad4b into master May 4, 2022
@joelit joelit deleted the issue1292-security-policy branch May 4, 2022 13:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@osma osma osma approved these changes

+1 more reviewer

@kinow kinow kinow approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@joelit joelit

Labels

maintenance Dependency changes, security updates, infrastructure tweaks & general mainenance needs discussion

Projects

None yet

Milestone

2.15

Development

Successfully merging this pull request may close these issues.

Create a SECURITY.md file

3 participants

@joelit @osma @kinow