Spaces:
Running
Running
text-generation-webui
/
installer_files
/env
/share
/doc
/git
/howto
/coordinate-embargoed-releases.html
| <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> | |
| <head> | |
| <meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" /> | |
| <meta name="generator" content="AsciiDoc 10.2.0" /> | |
| <title></title> | |
| <style type="text/css"> | |
| /* Shared CSS for AsciiDoc xhtml11 and html5 backends */ | |
| /* Default font. */ | |
| body { | |
| font-family: Georgia,serif; | |
| } | |
| /* Title font. */ | |
| h1, h2, h3, h4, h5, h6, | |
| div.title, caption.title, | |
| thead, p.table.header, | |
| #toctitle, | |
| #author, #revnumber, #revdate, #revremark, | |
| #footer { | |
| font-family: Arial,Helvetica,sans-serif; | |
| } | |
| body { | |
| margin: 1em 5% 1em 5%; | |
| } | |
| a { | |
| color: blue; | |
| text-decoration: underline; | |
| } | |
| a:visited { | |
| color: fuchsia; | |
| } | |
| em { | |
| font-style: italic; | |
| color: navy; | |
| } | |
| strong { | |
| font-weight: bold; | |
| color: #083194; | |
| } | |
| h1, h2, h3, h4, h5, h6 { | |
| color: #527bbd; | |
| margin-top: 1.2em; | |
| margin-bottom: 0.5em; | |
| line-height: 1.3; | |
| } | |
| h1, h2, h3 { | |
| border-bottom: 2px solid silver; | |
| } | |
| h2 { | |
| padding-top: 0.5em; | |
| } | |
| h3 { | |
| float: left; | |
| } | |
| h3 + * { | |
| clear: left; | |
| } | |
| h5 { | |
| font-size: 1.0em; | |
| } | |
| div.sectionbody { | |
| margin-left: 0; | |
| } | |
| hr { | |
| border: 1px solid silver; | |
| } | |
| p { | |
| margin-top: 0.5em; | |
| margin-bottom: 0.5em; | |
| } | |
| ul, ol, li > p { | |
| margin-top: 0; | |
| } | |
| ul > li { color: #aaa; } | |
| ul > li > * { color: black; } | |
| .monospaced, code, pre { | |
| font-family: "Courier New", Courier, monospace; | |
| font-size: inherit; | |
| color: navy; | |
| padding: 0; | |
| margin: 0; | |
| } | |
| pre { | |
| white-space: pre-wrap; | |
| } | |
| #author { | |
| color: #527bbd; | |
| font-weight: bold; | |
| font-size: 1.1em; | |
| } | |
| #email { | |
| } | |
| #revnumber, #revdate, #revremark { | |
| } | |
| #footer { | |
| font-size: small; | |
| border-top: 2px solid silver; | |
| padding-top: 0.5em; | |
| margin-top: 4.0em; | |
| } | |
| #footer-text { | |
| float: left; | |
| padding-bottom: 0.5em; | |
| } | |
| #footer-badges { | |
| float: right; | |
| padding-bottom: 0.5em; | |
| } | |
| #preamble { | |
| margin-top: 1.5em; | |
| margin-bottom: 1.5em; | |
| } | |
| div.imageblock, div.exampleblock, div.verseblock, | |
| div.quoteblock, div.literalblock, div.listingblock, div.sidebarblock, | |
| div.admonitionblock { | |
| margin-top: 1.0em; | |
| margin-bottom: 1.5em; | |
| } | |
| div.admonitionblock { | |
| margin-top: 2.0em; | |
| margin-bottom: 2.0em; | |
| margin-right: 10%; | |
| color: #606060; | |
| } | |
| div.content { /* Block element content. */ | |
| padding: 0; | |
| } | |
| /* Block element titles. */ | |
| div.title, caption.title { | |
| color: #527bbd; | |
| font-weight: bold; | |
| text-align: left; | |
| margin-top: 1.0em; | |
| margin-bottom: 0.5em; | |
| } | |
| div.title + * { | |
| margin-top: 0; | |
| } | |
| td div.title:first-child { | |
| margin-top: 0.0em; | |
| } | |
| div.content div.title:first-child { | |
| margin-top: 0.0em; | |
| } | |
| div.content + div.title { | |
| margin-top: 0.0em; | |
| } | |
| div.sidebarblock > div.content { | |
| background: #ffffee; | |
| border: 1px solid #dddddd; | |
| border-left: 4px solid #f0f0f0; | |
| padding: 0.5em; | |
| } | |
| div.listingblock > div.content { | |
| border: 1px solid #dddddd; | |
| border-left: 5px solid #f0f0f0; | |
| background: #f8f8f8; | |
| padding: 0.5em; | |
| } | |
| div.quoteblock, div.verseblock { | |
| padding-left: 1.0em; | |
| margin-left: 1.0em; | |
| margin-right: 10%; | |
| border-left: 5px solid #f0f0f0; | |
| color: #888; | |
| } | |
| div.quoteblock > div.attribution { | |
| padding-top: 0.5em; | |
| text-align: right; | |
| } | |
| div.verseblock > pre.content { | |
| font-family: inherit; | |
| font-size: inherit; | |
| } | |
| div.verseblock > div.attribution { | |
| padding-top: 0.75em; | |
| text-align: left; | |
| } | |
| /* DEPRECATED: Pre version 8.2.7 verse style literal block. */ | |
| div.verseblock + div.attribution { | |
| text-align: left; | |
| } | |
| div.admonitionblock .icon { | |
| vertical-align: top; | |
| font-size: 1.1em; | |
| font-weight: bold; | |
| text-decoration: underline; | |
| color: #527bbd; | |
| padding-right: 0.5em; | |
| } | |
| div.admonitionblock td.content { | |
| padding-left: 0.5em; | |
| border-left: 3px solid #dddddd; | |
| } | |
| div.exampleblock > div.content { | |
| border-left: 3px solid #dddddd; | |
| padding-left: 0.5em; | |
| } | |
| div.imageblock div.content { padding-left: 0; } | |
| span.image img { border-style: none; vertical-align: text-bottom; } | |
| a.image:visited { color: white; } | |
| dl { | |
| margin-top: 0.8em; | |
| margin-bottom: 0.8em; | |
| } | |
| dt { | |
| margin-top: 0.5em; | |
| margin-bottom: 0; | |
| font-style: normal; | |
| color: navy; | |
| } | |
| dd > *:first-child { | |
| margin-top: 0.1em; | |
| } | |
| ul, ol { | |
| list-style-position: outside; | |
| } | |
| ol.arabic { | |
| list-style-type: decimal; | |
| } | |
| ol.loweralpha { | |
| list-style-type: lower-alpha; | |
| } | |
| ol.upperalpha { | |
| list-style-type: upper-alpha; | |
| } | |
| ol.lowerroman { | |
| list-style-type: lower-roman; | |
| } | |
| ol.upperroman { | |
| list-style-type: upper-roman; | |
| } | |
| div.compact ul, div.compact ol, | |
| div.compact p, div.compact p, | |
| div.compact div, div.compact div { | |
| margin-top: 0.1em; | |
| margin-bottom: 0.1em; | |
| } | |
| tfoot { | |
| font-weight: bold; | |
| } | |
| td > div.verse { | |
| white-space: pre; | |
| } | |
| div.hdlist { | |
| margin-top: 0.8em; | |
| margin-bottom: 0.8em; | |
| } | |
| div.hdlist tr { | |
| padding-bottom: 15px; | |
| } | |
| dt.hdlist1.strong, td.hdlist1.strong { | |
| font-weight: bold; | |
| } | |
| td.hdlist1 { | |
| vertical-align: top; | |
| font-style: normal; | |
| padding-right: 0.8em; | |
| color: navy; | |
| } | |
| td.hdlist2 { | |
| vertical-align: top; | |
| } | |
| div.hdlist.compact tr { | |
| margin: 0; | |
| padding-bottom: 0; | |
| } | |
| .comment { | |
| background: yellow; | |
| } | |
| .footnote, .footnoteref { | |
| font-size: 0.8em; | |
| } | |
| span.footnote, span.footnoteref { | |
| vertical-align: super; | |
| } | |
| #footnotes { | |
| margin: 20px 0 20px 0; | |
| padding: 7px 0 0 0; | |
| } | |
| #footnotes div.footnote { | |
| margin: 0 0 5px 0; | |
| } | |
| #footnotes hr { | |
| border: none; | |
| border-top: 1px solid silver; | |
| height: 1px; | |
| text-align: left; | |
| margin-left: 0; | |
| width: 20%; | |
| min-width: 100px; | |
| } | |
| div.colist td { | |
| padding-right: 0.5em; | |
| padding-bottom: 0.3em; | |
| vertical-align: top; | |
| } | |
| div.colist td img { | |
| margin-top: 0.3em; | |
| } | |
| @media print { | |
| #footer-badges { display: none; } | |
| } | |
| #toc { | |
| margin-bottom: 2.5em; | |
| } | |
| #toctitle { | |
| color: #527bbd; | |
| font-size: 1.1em; | |
| font-weight: bold; | |
| margin-top: 1.0em; | |
| margin-bottom: 0.1em; | |
| } | |
| div.toclevel0, div.toclevel1, div.toclevel2, div.toclevel3, div.toclevel4 { | |
| margin-top: 0; | |
| margin-bottom: 0; | |
| } | |
| div.toclevel2 { | |
| margin-left: 2em; | |
| font-size: 0.9em; | |
| } | |
| div.toclevel3 { | |
| margin-left: 4em; | |
| font-size: 0.9em; | |
| } | |
| div.toclevel4 { | |
| margin-left: 6em; | |
| font-size: 0.9em; | |
| } | |
| span.aqua { color: aqua; } | |
| span.black { color: black; } | |
| span.blue { color: blue; } | |
| span.fuchsia { color: fuchsia; } | |
| span.gray { color: gray; } | |
| span.green { color: green; } | |
| span.lime { color: lime; } | |
| span.maroon { color: maroon; } | |
| span.navy { color: navy; } | |
| span.olive { color: olive; } | |
| span.purple { color: purple; } | |
| span.red { color: red; } | |
| span.silver { color: silver; } | |
| span.teal { color: teal; } | |
| span.white { color: white; } | |
| span.yellow { color: yellow; } | |
| span.aqua-background { background: aqua; } | |
| span.black-background { background: black; } | |
| span.blue-background { background: blue; } | |
| span.fuchsia-background { background: fuchsia; } | |
| span.gray-background { background: gray; } | |
| span.green-background { background: green; } | |
| span.lime-background { background: lime; } | |
| span.maroon-background { background: maroon; } | |
| span.navy-background { background: navy; } | |
| span.olive-background { background: olive; } | |
| span.purple-background { background: purple; } | |
| span.red-background { background: red; } | |
| span.silver-background { background: silver; } | |
| span.teal-background { background: teal; } | |
| span.white-background { background: white; } | |
| span.yellow-background { background: yellow; } | |
| span.big { font-size: 2em; } | |
| span.small { font-size: 0.6em; } | |
| span.underline { text-decoration: underline; } | |
| span.overline { text-decoration: overline; } | |
| span.line-through { text-decoration: line-through; } | |
| div.unbreakable { page-break-inside: avoid; } | |
| /* | |
| * xhtml11 specific | |
| * | |
| * */ | |
| div.tableblock { | |
| margin-top: 1.0em; | |
| margin-bottom: 1.5em; | |
| } | |
| div.tableblock > table { | |
| border: 3px solid #527bbd; | |
| } | |
| thead, p.table.header { | |
| font-weight: bold; | |
| color: #527bbd; | |
| } | |
| p.table { | |
| margin-top: 0; | |
| } | |
| /* Because the table frame attribute is overridden by CSS in most browsers. */ | |
| div.tableblock > table[frame="void"] { | |
| border-style: none; | |
| } | |
| div.tableblock > table[frame="hsides"] { | |
| border-left-style: none; | |
| border-right-style: none; | |
| } | |
| div.tableblock > table[frame="vsides"] { | |
| border-top-style: none; | |
| border-bottom-style: none; | |
| } | |
| /* | |
| * html5 specific | |
| * | |
| * */ | |
| table.tableblock { | |
| margin-top: 1.0em; | |
| margin-bottom: 1.5em; | |
| } | |
| thead, p.tableblock.header { | |
| font-weight: bold; | |
| color: #527bbd; | |
| } | |
| p.tableblock { | |
| margin-top: 0; | |
| } | |
| table.tableblock { | |
| border-width: 3px; | |
| border-spacing: 0px; | |
| border-style: solid; | |
| border-color: #527bbd; | |
| border-collapse: collapse; | |
| } | |
| th.tableblock, td.tableblock { | |
| border-width: 1px; | |
| padding: 4px; | |
| border-style: solid; | |
| border-color: #527bbd; | |
| } | |
| table.tableblock.frame-topbot { | |
| border-left-style: hidden; | |
| border-right-style: hidden; | |
| } | |
| table.tableblock.frame-sides { | |
| border-top-style: hidden; | |
| border-bottom-style: hidden; | |
| } | |
| table.tableblock.frame-none { | |
| border-style: hidden; | |
| } | |
| th.tableblock.halign-left, td.tableblock.halign-left { | |
| text-align: left; | |
| } | |
| th.tableblock.halign-center, td.tableblock.halign-center { | |
| text-align: center; | |
| } | |
| th.tableblock.halign-right, td.tableblock.halign-right { | |
| text-align: right; | |
| } | |
| th.tableblock.valign-top, td.tableblock.valign-top { | |
| vertical-align: top; | |
| } | |
| th.tableblock.valign-middle, td.tableblock.valign-middle { | |
| vertical-align: middle; | |
| } | |
| th.tableblock.valign-bottom, td.tableblock.valign-bottom { | |
| vertical-align: bottom; | |
| } | |
| /* | |
| * manpage specific | |
| * | |
| * */ | |
| body.manpage h1 { | |
| padding-top: 0.5em; | |
| padding-bottom: 0.5em; | |
| border-top: 2px solid silver; | |
| border-bottom: 2px solid silver; | |
| } | |
| body.manpage h2 { | |
| border-style: none; | |
| } | |
| body.manpage div.sectionbody { | |
| margin-left: 3em; | |
| } | |
| @media print { | |
| body.manpage div#toc { display: none; } | |
| } | |
| </style> | |
| <script type="text/javascript"> | |
| /*<+'])'); | |
| // Function that scans the DOM tree for header elements (the DOM2 | |
| // nodeIterator API would be a better technique but not supported by all | |
| // browsers). | |
| var iterate = function (el) { | |
| for (var i = el.firstChild; i != null; i = i.nextSibling) { | |
| if (i.nodeType == 1 /* Node.ELEMENT_NODE */) { | |
| var mo = re.exec(i.tagName); | |
| if (mo && (i.getAttribute("class") || i.getAttribute("className")) != "float") { | |
| result[result.length] = new TocEntry(i, getText(i), mo[1]-1); | |
| } | |
| iterate(i); | |
| } | |
| } | |
| } | |
| iterate(el); | |
| return result; | |
| } | |
| var toc = document.getElementById("toc"); | |
| if (!toc) { | |
| return; | |
| } | |
| // Delete existing TOC entries in case we're reloading the TOC. | |
| var tocEntriesToRemove = []; | |
| var i; | |
| for (i = 0; i < toc.childNodes.length; i++) { | |
| var entry = toc.childNodes[i]; | |
| if (entry.nodeName.toLowerCase() == 'div' | |
| && entry.getAttribute("class") | |
| && entry.getAttribute("class").match(/^toclevel/)) | |
| tocEntriesToRemove.push(entry); | |
| } | |
| for (i = 0; i < tocEntriesToRemove.length; i++) { | |
| toc.removeChild(tocEntriesToRemove[i]); | |
| } | |
| // Rebuild TOC entries. | |
| var entries = tocEntries(document.getElementById("content"), toclevels); | |
| for (var i = 0; i < entries.length; ++i) { | |
| var entry = entries[i]; | |
| if (entry.element.id == "") | |
| entry.element.id = "_toc_" + i; | |
| var a = document.createElement("a"); | |
| a.href = "#" + entry.element.id; | |
| a.appendChild(document.createTextNode(entry.text)); | |
| var div = document.createElement("div"); | |
| div.appendChild(a); | |
| div.className = "toclevel" + entry.toclevel; | |
| toc.appendChild(div); | |
| } | |
| if (entries.length == 0) | |
| toc.parentNode.removeChild(toc); | |
| }, | |
| ///////////////////////////////////////////////////////////////////// | |
| // Footnotes generator | |
| ///////////////////////////////////////////////////////////////////// | |
| /* Based on footnote generation code from: | |
| * http://www.brandspankingnew.net/archive/2005/07/format_footnote.html | |
| */ | |
| footnotes: function () { | |
| // Delete existing footnote entries in case we're reloading the footnodes. | |
| var i; | |
| var noteholder = document.getElementById("footnotes"); | |
| if (!noteholder) { | |
| return; | |
| } | |
| var entriesToRemove = []; | |
| for (i = 0; i < noteholder.childNodes.length; i++) { | |
| var entry = noteholder.childNodes[i]; | |
| if (entry.nodeName.toLowerCase() == 'div' && entry.getAttribute("class") == "footnote") | |
| entriesToRemove.push(entry); | |
| } | |
| for (i = 0; i < entriesToRemove.length; i++) { | |
| noteholder.removeChild(entriesToRemove[i]); | |
| } | |
| // Rebuild footnote entries. | |
| var cont = document.getElementById("content"); | |
| var spans = cont.getElementsByTagName("span"); | |
| var refs = {}; | |
| var n = 0; | |
| for (i=0; i<spans.length; i++) { | |
| if (spans[i].className == "footnote") { | |
| n++; | |
| var note = spans[i].getAttribute("data-note"); | |
| if (!note) { | |
| // Use [\s\S] in place of . so multi-line matches work. | |
| // Because JavaScript has no s (dotall) regex flag. | |
| note = spans[i].innerHTML.match(/\s*\[([\s\S]*)]\s*/)[1]; | |
| spans[i].innerHTML = | |
| "[<a id='_footnoteref_" + n + "' href='#_footnote_" + n + | |
| "' title='View footnote' class='footnote'>" + n + "</a>]"; | |
| spans[i].setAttribute("data-note", note); | |
| } | |
| noteholder.innerHTML += | |
| "<div class='footnote' id='_footnote_" + n + "'>" + | |
| "<a href='#_footnoteref_" + n + "' title='Return to text'>" + | |
| n + "</a>. " + note + "</div>"; | |
| var id =spans[i].getAttribute("id"); | |
| if (id != null) refs["#"+id] = n; | |
| } | |
| } | |
| if (n == 0) | |
| noteholder.parentNode.removeChild(noteholder); | |
| else { | |
| // Process footnoterefs. | |
| for (i=0; i<spans.length; i++) { | |
| if (spans[i].className == "footnoteref") { | |
| var href = spans[i].getElementsByTagName("a")[0].getAttribute("href"); | |
| href = href.match(/#.*/)[0]; // Because IE return full URL. | |
| n = refs[href]; | |
| spans[i].innerHTML = | |
| "[<a href='#_footnote_" + n + | |
| "' title='View footnote' class='footnote'>" + n + "</a>]"; | |
| } | |
| } | |
| } | |
| }, | |
| install: function(toclevels) { | |
| var timerId; | |
| function reinstall() { | |
| asciidoc.footnotes(); | |
| if (toclevels) { | |
| asciidoc.toc(toclevels); | |
| } | |
| } | |
| function reinstallAndRemoveTimer() { | |
| clearInterval(timerId); | |
| reinstall(); | |
| } | |
| timerId = setInterval(reinstall, 500); | |
| if (document.addEventListener) | |
| document.addEventListener("DOMContentLoaded", reinstallAndRemoveTimer, false); | |
| else | |
| window.onload = reinstallAndRemoveTimer; | |
| } | |
| } | |
| asciidoc.install(); | |
| /*]]>*/ | |
| </script> | |
| </head> | |
| <body class="article"> | |
| <div id="header"> | |
| </div> | |
| <div id="content"> | |
| <div class="sect1"> | |
| <h2 id="_how_we_coordinate_embargoed_releases">How we coordinate embargoed releases</h2> | |
| <div class="sectionbody"> | |
| <div class="paragraph"><p>To protect Git users from critical vulnerabilities, we do not just release | |
| fixed versions like regular maintenance releases. Instead, we coordinate | |
| releases with packagers, keeping the fixes under an embargo until the release | |
| date. That way, users will have a chance to upgrade on that date, no matter | |
| what Operating System or distribution they run.</p></div> | |
| </div> | |
| </div> | |
| <div class="sect1"> | |
| <h2 id="_the_code_git_security_code_mailing_list">The <code>git-security</code> mailing list</h2> | |
| <div class="sectionbody"> | |
| <div class="paragraph"><p>Responsible disclosures of vulnerabilities, analysis, proposed fixes as | |
| well as the orchestration of coordinated embargoed releases all happen on the | |
| <code>git-security</code> mailing list at <<a href="mailto:[email protected]">[email protected]</a>>.</p></div> | |
| <div class="paragraph"><p>In this context, the term "embargo" refers to the time period that information | |
| about a vulnerability is kept under wraps and only shared on a need-to-know | |
| basis. This is necessary to protect Git’s users from bad actors who would | |
| otherwise be made aware of attack vectors that could be exploited. "Lifting the | |
| embargo" refers to publishing the version that fixes the vulnerabilities.</p></div> | |
| <div class="sect2"> | |
| <h3 id="_audience_of_the_code_git_security_code_mailing_list">Audience of the <code>git-security</code> mailing list</h3> | |
| <div class="paragraph"><p>Anybody may contact the <code>git-security</code> mailing list by sending an email | |
| to <<a href="mailto:[email protected]">[email protected]</a>>, though the archive is closed to the | |
| public and only accessible to subscribed members.</p></div> | |
| <div class="paragraph"><p>There are a few dozen subscribed members: core Git developers who are trusted | |
| with addressing vulnerabilities, and stakeholders (i.e. owners of products | |
| affected by security vulnerabilities in Git).</p></div> | |
| <div class="paragraph"><p>Most of the discussions revolve around assessing the severity of the reported | |
| issue (including the decision whether the report is security-relevant or can be | |
| redirected to the public mailing list), how to remediate the issue, determining | |
| the timeline of the disclosure as well as aligning priorities and | |
| requirements.</p></div> | |
| </div> | |
| <div class="sect2"> | |
| <h3 id="_communications">Communications</h3> | |
| <div class="paragraph"><p>If you are a stakeholder, it is a good idea to pay close attention to the | |
| discussions, as pertinent information may be buried in the middle of a lively | |
| conversation that might not look relevant to your interests. For example, the | |
| tentative timeline might be agreed upon in the middle of discussing code | |
| comment formatting in one of the patches and whether or not to combine fixes | |
| for multiple, separate vulnerabilities into the same embargoed release. Most | |
| mail threads are not usually structured specifically to communicate | |
| agreements, assessments or timelines.</p></div> | |
| </div> | |
| </div> | |
| </div> | |
| <div class="sect1"> | |
| <h2 id="_typical_timeline">Typical timeline</h2> | |
| <div class="sectionbody"> | |
| <div class="ulist"><ul> | |
| <li> | |
| <p> | |
| A potential vulnerability is reported to the <code>git-security</code> mailing list. | |
| </p> | |
| </li> | |
| <li> | |
| <p> | |
| The members of the git-security list start a discussion to give an initial | |
| assessment of the severity of the reported potential vulnerability. | |
| We aspire to do so within a few days. | |
| </p> | |
| </li> | |
| <li> | |
| <p> | |
| After discussion, if consensus is reached that it is not critical enough | |
| to warrant any embargo, the reporter is redirected to the public Git mailing | |
| list. This ends the reporter’s interaction with the <code>git-security</code> list. | |
| </p> | |
| </li> | |
| <li> | |
| <p> | |
| If it is deemed critical enough for an embargo, ideas are presented on how to | |
| address the vulnerability. | |
| </p> | |
| </li> | |
| <li> | |
| <p> | |
| Usually around that time, the Git maintainer or their delegate(s) open a draft | |
| security advisory in the <code>git/git</code> repository on GitHub (see below for more | |
| details). | |
| </p> | |
| </li> | |
| <li> | |
| <p> | |
| Code review can take place in a variety of different locations, | |
| depending on context. These are: patches sent inline on the git-security list, | |
| a private fork on GitHub associated with the draft security advisory, or the | |
| git/cabal repository. | |
| </p> | |
| </li> | |
| <li> | |
| <p> | |
| Contributors working on a fix should consider beginning by sending | |
| patches to the git-security list (inline with the original thread), since they | |
| are accessible to all subscribers, along with the original reporter. | |
| </p> | |
| </li> | |
| <li> | |
| <p> | |
| Once the review has settled and everyone involved in the review agrees that | |
| the patches are nearing the finish line, the Git maintainer, and others | |
| determine a release date as well as the release trains that are serviced. The | |
| decision regarding which versions need a backported fix is based on input from | |
| the reporter, the contributor who worked on the patches, and from | |
| stakeholders. Operators of hosting sites who may want to analyze whether the | |
| given issue is exploited via any of the repositories they host, and binary | |
| packagers who want to make sure their product gets patched adequately against | |
| the vulnerability, for example, may want to give their input at this stage. | |
| </p> | |
| </li> | |
| <li> | |
| <p> | |
| While the Git community does its best to accommodate the specific timeline | |
| requests of the various binary packagers, the nature of the issue may preclude | |
| a prolonged release schedule. For fixes deemed urgent, it may be in the best | |
| interest of the Git users community to shorten the disclosure and release | |
| timeline, and packagers may need to adapt accordingly. | |
| </p> | |
| </li> | |
| <li> | |
| <p> | |
| Subsequently, branches with the fixes are pushed to the git/cabal repository. | |
| </p> | |
| </li> | |
| <li> | |
| <p> | |
| The tags are created by the Git maintainer and pushed to the same repository. | |
| </p> | |
| </li> | |
| <li> | |
| <p> | |
| The Git for Windows, Git for macOS, BSD, Debian, etc. maintainers prepare the | |
| corresponding release artifacts, based on the tags created that have been | |
| prepared by the Git maintainer. | |
| </p> | |
| </li> | |
| <li> | |
| <p> | |
| The release artifacts prepared by various binary packagers can be | |
| made available to stakeholders under embargo via a mail to the | |
| <code>git-security</code> list. | |
| </p> | |
| </li> | |
| <li> | |
| <p> | |
| Less than a week before the release, a mail with the relevant information is | |
| sent to <<a href="mailto:[email protected]">[email protected]</a>> (see below), a list used to pre-announce | |
| embargoed releases of open source projects to the stakeholders of all major | |
| distributions of Linux as well as other OSes. | |
| </p> | |
| </li> | |
| <li> | |
| <p> | |
| Public communication is then prepared in advance of the release date. This | |
| includes blog posts and mails to the Git and Git for Windows mailing lists. | |
| </p> | |
| </li> | |
| <li> | |
| <p> | |
| On the day of the release, at around 10am Pacific Time, the Git maintainer | |
| pushes the tag and the <code>master</code> branch to the public repository, then sends | |
| out an announcement mail. | |
| </p> | |
| </li> | |
| <li> | |
| <p> | |
| Once the tag is pushed, the Git for Windows maintainer publishes the | |
| corresponding tag and creates a GitHub Release with the associated release | |
| artifacts (Git for Windows installer, Portable Git, MinGit, etc). | |
| </p> | |
| </li> | |
| <li> | |
| <p> | |
| Git for Windows release is then announced via a mail to the public Git and | |
| Git for Windows mailing lists as well as via a tweet. | |
| </p> | |
| </li> | |
| <li> | |
| <p> | |
| Ditto for distribution packagers for Linux and other platforms: | |
| their releases are announced via their preferred channels. | |
| </p> | |
| </li> | |
| <li> | |
| <p> | |
| A mail to <<a href="mailto:[email protected]">[email protected]</a>> (see below for details) is sent | |
| as a follow-up to the <<a href="mailto:[email protected]">[email protected]</a>> one, describing the | |
| vulnerability in detail, often including a proof of concept of an exploit. | |
| </p> | |
| </li> | |
| </ul></div> | |
| <div class="paragraph"><p>Note: The Git project makes no guarantees about timelines, but aims to keep | |
| embargoes reasonably short in the interest of keeping Git’s users safe.</p></div> | |
| <div class="sect2"> | |
| <h3 id="_opening_a_security_advisory_draft">Opening a Security Advisory draft</h3> | |
| <div class="paragraph"><p>The first step is to <a href="https://github.com/git/git/security/advisories/new">open | |
| an advisory</a>. Technically, this is not necessary. However, it is the most | |
| convenient way to obtain the CVE number and it give us a private repository | |
| associated with it that can be used to collaborate on a fix.</p></div> | |
| </div> | |
| <div class="sect2"> | |
| <h3 id="_notifying_the_linux_distributions">Notifying the Linux distributions</h3> | |
| <div class="paragraph"><p>At most two weeks before release date, we need to send a notification to | |
| <<a href="mailto:[email protected]">[email protected]</a>>, preferably less than 7 days before the release date. | |
| This will reach most (all?) Linux distributions. See an example below, and the | |
| guidelines for this mailing list at | |
| <a href="https://oss-security.openwall.org/wiki/mailing-lists/distros#how-to-use-the-lists">here</a>.</p></div> | |
| <div class="paragraph"><p>Once the version has been published, we send a note about that to oss-security. | |
| As an example, see <a href="https://www.openwall.com/lists/oss-security/2019/12/13/1">the | |
| v2.24.1 mail</a>; | |
| <a href="https://oss-security.openwall.org/wiki/mailing-lists/oss-security">Here</a> are | |
| their guidelines.</p></div> | |
| <div class="paragraph"><p>The mail to oss-security should also describe the exploit, and give credit to | |
| the reporter(s): security researchers still receive too little respect for the | |
| invaluable service they provide, and public credit goes a long way to keep them | |
| paid by their respective organizations.</p></div> | |
| <div class="paragraph"><p>Technically, describing any exploit can be delayed up to 7 days, but we usually | |
| refrain from doing that, including it right away.</p></div> | |
| <div class="paragraph"><p>As a courtesy we typically attach a Git bundle (as <code>.tar.xz</code> because the list | |
| will drop <code>.bundle</code> attachments) in the mail to distros@ so that the involved | |
| parties can take care of integrating/backporting them. This bundle is typically | |
| created using a command like this:</p></div> | |
| <div class="literalblock"> | |
| <div class="content"> | |
| <pre><code>git bundle create cve-xxx.bundle ^origin/master vA.B.C vD.E.F | |
| tar cJvf cve-xxx.bundle.tar.xz cve-xxx.bundle</code></pre> | |
| </div></div> | |
| </div> | |
| <div class="sect2"> | |
| <h3 id="_example_mail_to_a_href_mailto_distros_vs_openwall_org_distros_vs_openwall_org_a">Example mail to <a href="mailto:[email protected]">[email protected]</a></h3> | |
| <div class="literalblock"> | |
| <div class="content"> | |
| <pre><code>To: [email protected] | |
| Cc: [email protected], <other people involved in the report/fix> | |
| Subject: [vs] Upcoming Git security fix release | |
| Team, | |
| The Git project will release new versions on <date> at 10am Pacific Time or | |
| soon thereafter. I have attached a Git bundle (embedded in a `.tar.xz` to avoid | |
| it being dropped) which you can fetch into a clone of | |
| https://github.com/git/git via `git fetch --tags /path/to/cve-xxx.bundle`, | |
| containing the tags for versions <versions>. | |
| You can verify with `git tag -v <tag>` that the versions were signed by | |
| the Git maintainer, using the same GPG key as e.g. v2.24.0. | |
| Please use these tags to prepare `git` packages for your various | |
| distributions, using the appropriate tagged versions. The added test cases | |
| help verify the correctness. | |
| The addressed issues are: | |
| <list of CVEs with a short description, typically copy/pasted from Git's | |
| release notes, usually demo exploit(s), too> | |
| Credit for finding the vulnerability goes to <reporter>, credit for fixing | |
| it goes to <developer>. | |
| Thanks, | |
| <name></code></pre> | |
| </div></div> | |
| </div> | |
| <div class="sect2"> | |
| <h3 id="_example_mail_to_a_href_mailto_oss_security_lists_openwall_com_oss_security_lists_openwall_com_a">Example mail to <a href="mailto:[email protected]">[email protected]</a></h3> | |
| <div class="literalblock"> | |
| <div class="content"> | |
| <pre><code>To: [email protected] | |
| Cc: [email protected], <other people involved in the report/fix> | |
| Subject: git: <copy from security advisory> | |
| Team, | |
| The Git project released new versions on <date>, addressing <CVE>. | |
| All supported platforms are affected in one way or another, and all Git | |
| versions all the way back to <version> are affected. The fixed versions are: | |
| <versions>. | |
| Link to the announcement: <link to lore.kernel.org/git> | |
| We highly recommend to upgrade. | |
| The addressed issues are: | |
| * <list of CVEs and their explanations, along with demo exploits> | |
| Credit for finding the vulnerability goes to <reporter>, credit for fixing | |
| it goes to <developer>. | |
| Thanks, | |
| <name></code></pre> | |
| </div></div> | |
| </div> | |
| </div> | |
| </div> | |
| </div> | |
| <div id="footnotes"><hr /></div> | |
| <div id="footer"> | |
| <div id="footer-text"> | |
| Last updated | |
| 2023-04-24 08:32:54 PDT | |
| </div> | |
| </div> | |
| </body> | |
| </html> | |