From a799d6b7a8313129ad57295572ac693ee18eaf9c Mon Sep 17 00:00:00 2001 From: Lars Kurth Date: Mon, 19 Mar 2018 16:03:11 +0100 Subject: [PATCH] Make Security Policy Doc ready to become a CNA To become a CNA, we need to more clearly specifiy the scope of security support. This change updates the document and points to SUPPORT.md and pages generated from SUPPORT.md Also fixed a typo in the following paragraph. Signed-off-by: Lars Kurth Acked-by: George Dunlap Acked-by: Juergen Gross Acked-by: Ian Jackson --- security-policy.html | 8 +++++++- security-policy.pandoc | 12 ++++++++++-- 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/security-policy.html b/security-policy.html index 6cc44c5..50e4d4e 100644 --- a/security-policy.html +++ b/security-policy.html @@ -3,7 +3,12 @@

Computer systems have bugs. Currently recognised best practice for bugs with security implications is to notify significant downstream users in private; leave a reasonable interval for downstreams to respond and prepare updated software packages; then make public disclosure.

We want to encourage people to report bugs they find to us. Therefore we will treat with respect the requests of discoverers, or other vendors, who report problems to us.

Scope of this process

-

This process primarily covers the Xen Hypervisor Project. Vulnerabilties reported against other Xen Project teams will be handled on a best effort basis by the relevant Project Lead together with the Security Response Team.

+

This process primarily covers the Xen Hypervisor Project. Specific information about features with security support can be found in

+
    +
  1. SUPPORT.md in the releases' tar ball and its xen.git tree and on web pages generated from the SUPPORT.md file
    2. +
  2. For releases that do not contain SUPPORT.md, this information can be found on the Release Feature wiki page
    3. +
+

Vulnerabilities reported against other Xen Project teams will be handled on a best effort basis by the relevant Project Lead together with the Security Response Team.

Specific process

  1. @@ -248,6 +253,7 @@ A role address (such as