Changes between Version 6 and Version 7 of SecurityVulnerabilityProcess

Timestamp:

Dec 19, 2009, 6:25:43 PM (14 years ago)

Author:

MarkDoliner

Comment:

--

SecurityVulnerabilityProcess

@@ -35 +35 @@
 }}}
    b. If the bug has already been announced publicly (on devel mailing list, IRC, or Jabber conference), send all information about the bug to security@pidgin.im
- 2. Developers on the security email list should determine an appropriate fix and create a patch.
- 2. Once an agreed upon patch has been created, an email based on this template should be sent to the packagers mailing list:
+ 2. Developers on the security email list should determine an appropriate fix and create a patch.  Do not share it publicly, but do get it reviewed and tested by other developers.
+ 2. Once an agreed upon patch has been created, an email based on this template should be sent to the packagers mailing list with the diff attached:
 {{{
 A security vulnerability has been discovered in [Pidgin|Finch|libpurple|other]
@@ -44 +44 @@
 Embargo date: [Either "none" or the agreed upon date]
 }}}
- 2. Announce to the world, create new packages, update security page
+ 2. As the embargo date approaches, a developer should be chosen to commit the fix to their repository.  Do not push yet, but go through the normal release process and prepare the ChangeLog, NEWS, etc.  This developer should also create (but not upload) tarballs.  It's often nice to provide the tarball to packagers prior to the embargo date.
+ 2. On the day of the embargo, push the changes to the repository and update http://pidgin.im/news/security/