As you can read in the Security Process, security reports must be handled in private by the PMC. You should not create a public Jira ticket to track the issue, or a public GitHub issue, since those would make the issue public. Messages associated with any commits should not make any reference to the security nature of the commit. The first point that any information regarding the vulnerability is made public is when the advisory is published after the release with the fix has been announced. See Working In Private for more notes on how to do this in practice.

Nonetheless, the PMC can ask for help in handling security issues: if the PMC does not have the bandwidth to handle issues within a reasonable time, or if they want to ask the help of a trusted community member or outside subject matter expert, they can share information about the report in private on a one-on-one need-to-know basis. As with all communication around security issues, it is recommended to Cc security@apache.org in the exchange. Of course, it should be clear that you expect them to keep the shared information private.

If a trusted committer has helped out on a one-on-one basis for a while, this might be a motivation to invite them to join the PMC.

Creating a 'security@<project>.apache.org' mailinglist

If your project handles many security reports, it can be helpful to introduce a private security@<project>.apache.org mailinglist. If such a list exists, security reports will be sent to this list instead of to the PMC, and the ASF Security Team will no longer respond with a 'receipt confirmation' to the reporter - this is now your responsibility. The list should have enough members to make sure the project can deal with any incoming messages about security issues responsibly and timely.

How you as PMC invite and rotate the members of your security team is up to you to decide. For inspiration, you could have a look at how the Airflow PMC has arranged this. For example, it is encouraged to periodically rotate out participants from outside the PMC that are not actively contributing.

Once you have agreement in the PMC on how you want to manage your security list, you can create the list via selfservice (it will recognize the 'security' list name and set it up accordingly) and notify security@apache.org of your policy.

Unfortunately, due to technical/least-privilege constraints, currently only PMC members can visit the security list archives at https://lists.apache.org/, so if you want to share old reports with new members you'll have to forward them.

  • No labels