)]}'
{"reference/tags/vulnerability_managed.rst":[{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"42d2c893c72f159117c38e5d00392c28619c99ae","unresolved":false,"context_lines":[{"line_number":41,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"1. Since the vulnerability:managed governance tag applies to"},{"line_number":44,"context_line":"   deliverables, all repos within a given deliverable must meet the"},{"line_number":45,"context_line":"   qualifying criteria. This means that if some repos in a"},{"line_number":46,"context_line":"   deliverable are in good enough shape to qualify, their"},{"line_number":47,"context_line":"   vulnerability management could be held back by other repos in the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a1a9d01_6ce71f13","line":44,"updated":"2015-09-24 15:39:19.000000000","message":"See I2aa729d1b4278743a5e99b41178dc2d11b3e1348 which introduced deliverables and got rid of per-repo governance tags. Basically deliverables are groups of closely related repos under the same project-team (for example, the \"neutron\" deliverable includes the repos for neutron and neutron-.*aas).","commit_id":"da97bcfa14f7f53615a4dd4f17f311c53472c505"},{"author":{"_account_id":6783,"name":"Nathan Reller","email":"nathan.s.reller@gmail.com","username":"rellerreller"},"change_message_id":"3d7200ee41fc427e748e928476806906ec599821","unresolved":false,"context_lines":[{"line_number":41,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"1. Since the vulnerability:managed governance tag applies to"},{"line_number":44,"context_line":"   deliverables, all repos within a given deliverable must meet the"},{"line_number":45,"context_line":"   qualifying criteria. This means that if some repos in a"},{"line_number":46,"context_line":"   deliverable are in good enough shape to qualify, their"},{"line_number":47,"context_line":"   vulnerability management could be held back by other repos in the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba15a1d1_17990b79","line":44,"updated":"2015-09-24 13:06:06.000000000","message":"This might be a dumb question, but what is the definition of a deliverable and repo in this context? Would the list of requirements be repos in a deliverable? An example or two would help me.","commit_id":"da97bcfa14f7f53615a4dd4f17f311c53472c505"},{"author":{"_account_id":6783,"name":"Nathan Reller","email":"nathan.s.reller@gmail.com","username":"rellerreller"},"change_message_id":"8de0c46eb26d0a7c2100226a455a77de094dd487","unresolved":false,"context_lines":[{"line_number":41,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"1. Since the vulnerability:managed governance tag applies to"},{"line_number":44,"context_line":"   deliverables, all repos within a given deliverable must meet the"},{"line_number":45,"context_line":"   qualifying criteria. This means that if some repos in a"},{"line_number":46,"context_line":"   deliverable are in good enough shape to qualify, their"},{"line_number":47,"context_line":"   vulnerability management could be held back by other repos in the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a1a9d01_0bad04e9","line":44,"in_reply_to":"9a1a9d01_6ce71f13","updated":"2015-09-25 13:26:55.000000000","message":"Thanks for the link. This is what I thought, and I\u0027m glad that it is documented somewhere.","commit_id":"da97bcfa14f7f53615a4dd4f17f311c53472c505"},{"author":{"_account_id":6783,"name":"Nathan Reller","email":"nathan.s.reller@gmail.com","username":"rellerreller"},"change_message_id":"3d7200ee41fc427e748e928476806906ec599821","unresolved":false,"context_lines":[{"line_number":59,"context_line":"   is to be able to confirm whether a bug report is"},{"line_number":60,"context_line":"   accurate/applicable or at least know other subject matter experts"},{"line_number":61,"context_line":"   they can in turn subscribe to perform those activities in a"},{"line_number":62,"context_line":"   timely manner. They should also be able to review and provide"},{"line_number":63,"context_line":"   pre-approval of patches attached to private bugs, which is why at"},{"line_number":64,"context_line":"   least a majority are expected to be core reviewers for the"},{"line_number":65,"context_line":"   deliverable. These should be members of a group contact (for"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba15a1d1_970d1b91","line":62,"updated":"2015-09-24 13:06:06.000000000","message":"Does it matter how many core reviewers there are? It seems like no matter how many core reviewers you have that you need a subset of them to handle security vulnerabilities.","commit_id":"da97bcfa14f7f53615a4dd4f17f311c53472c505"},{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"42d2c893c72f159117c38e5d00392c28619c99ae","unresolved":false,"context_lines":[{"line_number":59,"context_line":"   is to be able to confirm whether a bug report is"},{"line_number":60,"context_line":"   accurate/applicable or at least know other subject matter experts"},{"line_number":61,"context_line":"   they can in turn subscribe to perform those activities in a"},{"line_number":62,"context_line":"   timely manner. They should also be able to review and provide"},{"line_number":63,"context_line":"   pre-approval of patches attached to private bugs, which is why at"},{"line_number":64,"context_line":"   least a majority are expected to be core reviewers for the"},{"line_number":65,"context_line":"   deliverable. These should be members of a group contact (for"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a1a9d01_8ce4f30d","line":62,"updated":"2015-09-24 15:39:19.000000000","message":"In mathematical terms you need a \"proper subset\" which could be up to and including all members of the original set. The idea here was to attempt to limit the number of reviewers doing second-stage triage on a suspected vulnerability rather than situations like we have now where some projects have their 20+ core review team automatically added to these instead even though only a small number of those actively participate in the end and the remainder are mostly a liability).","commit_id":"da97bcfa14f7f53615a4dd4f17f311c53472c505"},{"author":{"_account_id":6783,"name":"Nathan Reller","email":"nathan.s.reller@gmail.com","username":"rellerreller"},"change_message_id":"3d7200ee41fc427e748e928476806906ec599821","unresolved":false,"context_lines":[{"line_number":93,"context_line":"   safely. The VMT doesn\u0027t stipulate who would actually perform this"},{"line_number":94,"context_line":"   review; for example members of the OpenStack Security"},{"line_number":95,"context_line":"   project-team might volunteer to provide their expertise or some"},{"line_number":96,"context_line":"   other third party may offer assistance."},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"6. All repos for the deliverable covered should have automated"},{"line_number":99,"context_line":"   testing for important features. Tests need to be feasible for the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba15a1d1_b765bf1e","line":96,"updated":"2015-09-24 13:06:06.000000000","message":"I believe you should stipulate who is qualified or the qualifications for such an auditor. My concern would be that the OSSG might be busy, or maybe I am a new project that does not yet have much support. In that case it may be difficult to use a standard auditor that other projects are using, such as OSSG. In that case I could have some interns or grad students for a project review my code and say that is good enough. I think you need to trust the auditor or else this loses its value.\n\nMy other concern is that if the auditors are within the community then that will be a limited resource. I\u0027m not sure if the OSSG could support all projects.\n\nI agree with the idea, but I\u0027m wondering about the implementation of it.\n\nThoughts?","commit_id":"da97bcfa14f7f53615a4dd4f17f311c53472c505"},{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"42d2c893c72f159117c38e5d00392c28619c99ae","unresolved":false,"context_lines":[{"line_number":93,"context_line":"   safely. The VMT doesn\u0027t stipulate who would actually perform this"},{"line_number":94,"context_line":"   review; for example members of the OpenStack Security"},{"line_number":95,"context_line":"   project-team might volunteer to provide their expertise or some"},{"line_number":96,"context_line":"   other third party may offer assistance."},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"6. All repos for the deliverable covered should have automated"},{"line_number":99,"context_line":"   testing for important features. Tests need to be feasible for the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a1a9d01_2cf127ce","line":96,"updated":"2015-09-24 15:39:19.000000000","message":"This was ultimately a compromise. The size of the VMT precludes it from having sufficient bandwidth to audit every project who might want to request its oversight on vulnerability reporting, but also lacks any authority to assign resources from elsewhere to do the same. The intent of this requirement was to strongly encourage applying project teams to have someone else with half a clue at least look over their software and point out obvious security flaws before hand (to avoid a flood of new vulnerabilities getting dumped on the VMT the first time someone runs a some common analysis tools on it). It\u0027s by no means a guarantee of anything, just trying to keep the workload to a reasonably unreasonable level.","commit_id":"da97bcfa14f7f53615a4dd4f17f311c53472c505"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"6de513125dedcc7c1be090fa49b1b5b263120611","unresolved":false,"context_lines":[{"line_number":93,"context_line":"   safely. The VMT doesn\u0027t stipulate who would actually perform this"},{"line_number":94,"context_line":"   review; for example members of the OpenStack Security"},{"line_number":95,"context_line":"   project-team might volunteer to provide their expertise or some"},{"line_number":96,"context_line":"   other third party may offer assistance."},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"6. All repos for the deliverable covered should have automated"},{"line_number":99,"context_line":"   testing for important features. Tests need to be feasible for the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a1a9d01_c5d079cc","line":96,"in_reply_to":"9a1a9d01_2cf127ce","updated":"2015-09-24 18:51:45.000000000","message":"i wonder if there might be some sort of checklist that could be developed to help new projects seeking the vulnerability:managed tag?\n\nfor example, bandit gate, threat analysis, etc. this may tie in nicely to the work that the security team is doing to formalize these proceedures.","commit_id":"da97bcfa14f7f53615a4dd4f17f311c53472c505"},{"author":{"_account_id":6783,"name":"Nathan Reller","email":"nathan.s.reller@gmail.com","username":"rellerreller"},"change_message_id":"8de0c46eb26d0a7c2100226a455a77de094dd487","unresolved":false,"context_lines":[{"line_number":93,"context_line":"   safely. The VMT doesn\u0027t stipulate who would actually perform this"},{"line_number":94,"context_line":"   review; for example members of the OpenStack Security"},{"line_number":95,"context_line":"   project-team might volunteer to provide their expertise or some"},{"line_number":96,"context_line":"   other third party may offer assistance."},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"6. All repos for the deliverable covered should have automated"},{"line_number":99,"context_line":"   testing for important features. Tests need to be feasible for the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a1a9d01_eba3f09c","line":96,"in_reply_to":"9a1a9d01_496323b2","updated":"2015-09-25 13:26:55.000000000","message":"A checklist might be doable if you stipulate what you are looking for in generic terms. For instance you could have an item for static code analysis and have as examples FindBugs and Bandit. If anything is not on the list then raise it to the community to vote if should accept or not.\n\nThis seems like a difficult task because if there are not specifics then the tag loses meaning. As a user I would have to search to see how each project did an audit. At that point what does the tag provide me?","commit_id":"da97bcfa14f7f53615a4dd4f17f311c53472c505"},{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"981b4125a987816e2476468aeb3922dc4b37886d","unresolved":false,"context_lines":[{"line_number":93,"context_line":"   safely. The VMT doesn\u0027t stipulate who would actually perform this"},{"line_number":94,"context_line":"   review; for example members of the OpenStack Security"},{"line_number":95,"context_line":"   project-team might volunteer to provide their expertise or some"},{"line_number":96,"context_line":"   other third party may offer assistance."},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"6. All repos for the deliverable covered should have automated"},{"line_number":99,"context_line":"   testing for important features. Tests need to be feasible for the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a1a9d01_496323b2","line":96,"in_reply_to":"9a1a9d01_c5d079cc","updated":"2015-09-24 19:01:39.000000000","message":"This list of tag application criteria endeavors to be that checklist. However I steered clear of things like requiring bandit gating because the VMT has agreed it is willing to also support projects which are not written primarily in Python (and bandit is clearly Python-specific).","commit_id":"da97bcfa14f7f53615a4dd4f17f311c53472c505"},{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"d3add3069bddf6fb13c25104201df5cc0ec4ff36","unresolved":false,"context_lines":[{"line_number":93,"context_line":"   safely. The VMT doesn\u0027t stipulate who would actually perform this"},{"line_number":94,"context_line":"   review; for example members of the OpenStack Security"},{"line_number":95,"context_line":"   project-team might volunteer to provide their expertise or some"},{"line_number":96,"context_line":"   other third party may offer assistance."},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"6. All repos for the deliverable covered should have automated"},{"line_number":99,"context_line":"   testing for important features. Tests need to be feasible for the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a1a9d01_c68dc37c","line":96,"in_reply_to":"9a1a9d01_eba3f09c","updated":"2015-09-25 15:10:34.000000000","message":"The only information this tag is meant to convey is that a \"repository\u0027s [sic, should be deliverable\u0027s now once I54292e21876638299628c0bc3c184eea4c6bf67f is approved] vulnerability report reception and disclosure are handled directly by the OpenStack Vulnerability Management team.\" The requirements being added here are meant to provide a checklist for the VMT and TC when deciding whether a deliverable can be directly supported by the VMT in this manner, and to provide guidelines for projects applying for this assistance so that they have some idea of what to expect.\n\nThis proposed change is basically codifying the loose criteria used in the past by the VMT (which really should have been formalized and published sooner). Now with the advent of the Big Tent we\u0027re basically trying to follow the examples set by similar cross-project teams in recording what was previously tribal knowledge before it\u0027s lost in the sea of newcomers to our community.","commit_id":"da97bcfa14f7f53615a4dd4f17f311c53472c505"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"37c5dedfbda295515727878e90270bd8869b6152","unresolved":false,"context_lines":[{"line_number":93,"context_line":"   safely. The VMT doesn\u0027t stipulate who would actually perform this"},{"line_number":94,"context_line":"   review; for example members of the OpenStack Security"},{"line_number":95,"context_line":"   project-team might volunteer to provide their expertise or some"},{"line_number":96,"context_line":"   other third party may offer assistance."},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"6. All repos for the deliverable covered should have automated"},{"line_number":99,"context_line":"   testing for important features. Tests need to be feasible for the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a1a9d01_da4ce178","line":96,"in_reply_to":"ba15a1d1_b765bf1e","updated":"2015-09-24 13:58:39.000000000","message":"this seems like a really difficult area to define. what criteria would be used to determine if a third-party was qualified to perform the audit?\n\nit\u0027s nice to have the ossg as one possible avenue for reliable auditing, but as you note this may present a strain on that team\u0027s resources.\n\ni\u0027m not sure how much we could define a set of parameters for auditors, but maybe we should just indicate that auditors should be familiar with the project in question and have a history of contribution to these type of efforts?\n\n(i really dislike the idea of discouraging new people from getting involved, but understand that we may not want someone with no experience to be doing this)","commit_id":"da97bcfa14f7f53615a4dd4f17f311c53472c505"}]}