Security/Security Note Process - Revision history

Brian-rosmaita: Updated mailing lists info

2020-05-29T13:54:00Z

Updated mailing lists info

2016-08-17T21:42:56Z

‎Reviewing Bugs

2016-08-17T21:41:31Z

‎Reviewing Bugs

2016-08-17T21:39:53Z

‎Process

2016-08-17T21:38:28Z

‎Reviewing Bugs

2016-08-17T21:29:41Z

‎Reviewing Bugs

2016-08-17T21:21:31Z

‎Reviewing Bugs

2016-08-17T20:40:32Z

‎Reviewing Bugs

2016-08-17T20:37:13Z

2016-08-17T19:23:36Z

‎Number Assignment

@@ Line 85: / Line 85: @@
 Once a Security Note has been published on the wiki, it should be sent to the following mailing lists:
-* openstack-dev@lists.openstack.org
+* openstack-discuss@lists.openstack.org
-* openstack@lists.openstack.org
+* openstack-announce@lists.openstack.org
 The e-mails should be signed, and the subject should be in the form of '''[OSSN ''number''] ''Title'''''.  The body of the e-mail should use the format from the template above.

@@ Line 16: / Line 16: @@
 The list of bugs requiring OSSNs to be written is maintained here: https://bugs.launchpad.net/ossn and should look similar to the list below
-[[File:Example OSSN Bug List.png|frameless|center|Screenshot of OSSN bug tracker from Launchpad]]
+[[File:Example OSSN Bug List.png|frameless|center|680px|Screenshot of OSSN bug tracker from Launchpad]]
 Bugs have a number of different status and the labels that Launchpad uses are geared more towards code development than documentation, however interpret the different statuses as follows:

@@ Line 20: / Line 20: @@
 Bugs have a number of different status and the labels that Launchpad uses are geared more towards code development than documentation, however interpret the different statuses as follows:
-New => This bug is new, the OSSP have not confirmed they will write a note for this
+{| class="wikitable"
-Won't Fix => The OSSP will not issue a note relating to this bug
+|-
-Confirmed => The OSSP will write a bug for this
+| New || This bug is new, the OSSP have not confirmed they will write a note for this
-In Progress => This bug is assigned to a member of the OSSP who is actively working on the problem
+|-
-Fix Released => A security note has been published for this issue
+| Won't Fix || The OSSP will not issue a note relating to this bug
 There are additional statuses that can be applied to a project including "Incomplete, Opinion, Invalid, Triaged, Fix Committed" - the Security Project does not currently use these tags for managing Security Notes. If you see a note with one of these tags you should raise the issue on IRC or via the mailing list.

@@ Line 10: / Line 10: @@
 == Process ==
 Typically a third party will file a security bug in OpenStack via [https://bugs.launchpad.net/openstack Launchpad]. If the VMT decides that it might be valid but doesn't qualify for an OSSA they will add the "OpenStack Security Notes" team to the "also affected" section of the bug. Launchpad bugs can affect multiple teams, adding the Security Notes team to the bug is the primary way we are notified that there is an issue we need to address.
 == Reviewing Bugs ==

← Older revision		Revision as of 21:38, 17 August 2016
Line 15:		Line 15:

	[[File:Example OSSN Bug List.png\|frameless\|center\|Screenshot of OSSN bug tracker from Launchpad]]		[[File:Example OSSN Bug List.png\|frameless\|center\|Screenshot of OSSN bug tracker from Launchpad]]
		+
		+	Bugs have a number of different status and the labels that Launchpad uses are geared more towards code development than documentation, however interpret the different statuses as follows:
		+
		+	New => This bug is new, the OSSP have not confirmed they will write a note for this
		+	Won't Fix => The OSSP will not issue a note relating to this bug
		+	Confirmed => The OSSP will write a bug for this
		+	In Progress => This bug is assigned to a member of the OSSP who is actively working on the problem
		+	Fix Released => A security note has been published for this issue
		+
		+	There are additional statuses that can be applied to a project including "Incomplete, Opinion, Invalid, Triaged, Fix Committed" - the Security Project does not currently use these tags for managing Security Notes. If you see a note with one of these tags you should raise the issue on IRC or via the mailing list.

	== Writing ==		== Writing ==

@@ Line 14: / Line 14: @@
 The list of bugs requiring OSSNs to be written is maintained here: https://bugs.launchpad.net/ossn and should look similar to the list below
-[[File:Example OSSN Bug List.png|thumb|Screen shot of OSSN bug tracker from Launchpad]]
+[[File:Example OSSN Bug List.png|frameless|center|Screenshot of OSSN bug tracker from Launchpad]]
 == Writing ==

@@ Line 1: / Line 1: @@
-This page describes the process that should be followed for writing and publishing an OpenStack Security Note (OSSN).  This page is intended to be used by members of the OpenStack Security Group.
+This page describes the process that should be followed for writing and publishing an OpenStack Security Note (OSSN).  This page is intended to be used by members of the OpenStack Security Project.
 == Writing ==
 When writing a new Security Note, you should ensure that the target audience will be able to clearly answer the following questions once they have read the Security Note:

← Older revision		Revision as of 19:23, 17 August 2016
Line 20:		Line 20:

	* OSSN-1234 - My new Security Note '''(work in progress)'''		* OSSN-1234 - My new Security Note '''(work in progress)'''
		+
		+	Save the page, then click the link you just added, to create a new page. Paste in the title of the OSSN and a link to the launchpad bug, then save the page.

	=== Templates ===		=== Templates ===