)]}'
{"reference/tags/vulnerability_managed.rst":[{"author":{"_account_id":2834,"name":"Steven Dake","email":"steven.dake@gmail.com","username":"sdake"},"change_message_id":"f22434a0cc40ab56376b0002c30a1c5e15c28caa","unresolved":false,"context_lines":[{"line_number":91,"context_line":"   be done by the project team itself or an impartial third party."},{"line_number":92,"context_line":"   In the event the project team involved in the tagging peforms"},{"line_number":93,"context_line":"   the review, audit, or threat analysis, the results must be"},{"line_number":94,"context_line":"   validated by a third party in public fashion.  The VMT doesn\u0027t"},{"line_number":95,"context_line":"   stipulate which third party would perform this review or"},{"line_number":96,"context_line":"   validation; for example members of the OpenStack Security"},{"line_number":97,"context_line":"   project-team might volunteer to provide their expertise or some"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a1b2928_3dac10ed","line":94,"range":{"start_line":94,"start_character":33,"end_line":94,"end_character":47},"updated":"2016-04-11 05:09:02.000000000","message":"note as the author of this motion, I don\u0027t like the wording \"public fashion\".  It lacks explicit actionable steps.  I struggled writing something fair and clear here though.  I thought something like \"validated by a third party and confirmed in the openstack-dev mialing list.\" but thought that was clunky and could get buried in the mailing list.  The longer term solution is to add a new tag such as vulnerability_analyzed and make section 5 dependent on the execution of that tag process, whatever it may be ;)\n\nOpen to suggestions :)","commit_id":"8b33c9d4978e9dfdfc0feccf72b0a4aa5cc4ec11"},{"author":{"_account_id":9311,"name":"Tristan Cacqueray","email":"tdecacqu@redhat.com","username":"tristanC"},"change_message_id":"433b69e2e656c7c8055775043161f1829033b9ff","unresolved":false,"context_lines":[{"line_number":91,"context_line":"   be done by the project team itself or an impartial third party."},{"line_number":92,"context_line":"   In the event the project team involved in the tagging peforms"},{"line_number":93,"context_line":"   the review, audit, or threat analysis, the results must be"},{"line_number":94,"context_line":"   validated by a third party in public fashion.  The VMT doesn\u0027t"},{"line_number":95,"context_line":"   stipulate which third party would perform this review or"},{"line_number":96,"context_line":"   validation; for example members of the OpenStack Security"},{"line_number":97,"context_line":"   project-team might volunteer to provide their expertise or some"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a18252c_b0ff7c00","line":94,"range":{"start_line":94,"start_character":33,"end_line":94,"end_character":47},"in_reply_to":"7a1b2928_3dac10ed","updated":"2016-04-12 19:14:14.000000000","message":"I would drop this mention entirely as it suggests some other validation doesn\u0027t happen in \"public fashion\". Ultimately it will be up to the TC and the VMT to approve a new project, and I\u0027m not sure this is going to happen based on a \"private\" validation.\n\nPerhaps this should mention a proper licensing so that the document could be published somewhere for the community ?","commit_id":"8b33c9d4978e9dfdfc0feccf72b0a4aa5cc4ec11"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"687a3c3364ff5838f0c374dfedc8ab69faf3d6cc","unresolved":false,"context_lines":[{"line_number":97,"context_line":"   project-team might volunteer to provide their expertise or some"},{"line_number":98,"context_line":"   other third party including sponsoring companies of a project may"},{"line_number":99,"context_line":"   offer assistance. As much as anything this is a measure to keep"},{"line_number":100,"context_line":"   the VMT\u0027s workload down, since it is by necessity a group of"},{"line_number":101,"context_line":"   constrained size and some of its processes simply can\u0027t be scaled"},{"line_number":102,"context_line":"   safely."},{"line_number":103,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba0121b8_708506ac","line":100,"updated":"2016-04-02 15:03:58.000000000","message":"I am not sure the justification to keep the workload down is needed here (it could be part of the commit message). It doesn\u0027t hurt the clarification, but justification in the docs isn\u0027t always needed beyond the prescription for the parties involved with the analysis.\n\nThe verbiage here is definitely a good clarification representing the requirements for the review, audit, and/or thread analysis.","commit_id":"8b33c9d4978e9dfdfc0feccf72b0a4aa5cc4ec11"},{"author":{"_account_id":2834,"name":"Steven Dake","email":"steven.dake@gmail.com","username":"sdake"},"change_message_id":"3c2294bafa4df5bfaadafa03fce7ff532f73ab5d","unresolved":false,"context_lines":[{"line_number":97,"context_line":"   project-team might volunteer to provide their expertise or some"},{"line_number":98,"context_line":"   other third party including sponsoring companies of a project may"},{"line_number":99,"context_line":"   offer assistance. As much as anything this is a measure to keep"},{"line_number":100,"context_line":"   the VMT\u0027s workload down, since it is by necessity a group of"},{"line_number":101,"context_line":"   constrained size and some of its processes simply can\u0027t be scaled"},{"line_number":102,"context_line":"   safely."},{"line_number":103,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba0121b8_beb80f2c","line":100,"in_reply_to":"ba0121b8_708506ac","updated":"2016-04-02 16:36:45.000000000","message":"Morgan,\n\nThe justification was already there in the document.  I suspect it got put there for a reason (probably to explain why to have such an onerous requirement that requires R\u0026D dollars for a community project) so I left it intact.","commit_id":"8b33c9d4978e9dfdfc0feccf72b0a4aa5cc4ec11"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"36447df4e23118690926dd137a27f86f41377ca9","unresolved":false,"context_lines":[{"line_number":97,"context_line":"   project-team might volunteer to provide their expertise or some"},{"line_number":98,"context_line":"   other third party including sponsoring companies of a project may"},{"line_number":99,"context_line":"   offer assistance. As much as anything this is a measure to keep"},{"line_number":100,"context_line":"   the VMT\u0027s workload down, since it is by necessity a group of"},{"line_number":101,"context_line":"   constrained size and some of its processes simply can\u0027t be scaled"},{"line_number":102,"context_line":"   safely."},{"line_number":103,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba0121b8_debfc35e","line":100,"in_reply_to":"ba0121b8_beb80f2c","updated":"2016-04-02 17:21:33.000000000","message":"right. hence the +1. Just commented that it feels superfluous with the more specific outline of who does the analysis","commit_id":"8b33c9d4978e9dfdfc0feccf72b0a4aa5cc4ec11"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"e4b5be546f326f398a096bcb37f7d9b6ccd7c16e","unresolved":false,"context_lines":[{"line_number":97,"context_line":"   project-team might volunteer to provide their expertise or some"},{"line_number":98,"context_line":"   other third party including sponsoring companies of a project may"},{"line_number":99,"context_line":"   offer assistance. As much as anything this is a measure to keep"},{"line_number":100,"context_line":"   the VMT\u0027s workload down, since it is by necessity a group of"},{"line_number":101,"context_line":"   constrained size and some of its processes simply can\u0027t be scaled"},{"line_number":102,"context_line":"   safely."},{"line_number":103,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a061dce_7f0bfe7d","line":100,"in_reply_to":"ba0121b8_debfc35e","updated":"2016-04-08 19:19:12.000000000","message":"I like the extra explicitness of the \"why\" being in the doc itself.","commit_id":"8b33c9d4978e9dfdfc0feccf72b0a4aa5cc4ec11"},{"author":{"_account_id":9311,"name":"Tristan Cacqueray","email":"tdecacqu@redhat.com","username":"tristanC"},"change_message_id":"00684131bddfb3788f906b34ee8e9538a8c6be55","unresolved":false,"context_lines":[{"line_number":100,"context_line":"   since it is by necessity a group of constrained size and some"},{"line_number":101,"context_line":"   of its processes simply can\u0027t be scaled safely.  Finally, the"},{"line_number":102,"context_line":"   results of the review, audit, or threat analysis must"},{"line_number":103,"context_line":"   be published by gerrit review and approval in the \u0027security"},{"line_number":104,"context_line":"   documentaton repository"},{"line_number":105,"context_line":"   http://git.openstack.org/cgit/openstack/security-doc/\u0027__."},{"line_number":106,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9abb7d3a_a5b61688","line":103,"range":{"start_line":103,"start_character":6,"end_line":103,"end_character":25},"updated":"2016-05-27 19:40:52.000000000","message":"How about \u0027must be proposed as a gerrit review and approved by the OpenStack Security Project (\"OSSP\")\u0027 ?","commit_id":"9e90bf9949afba655c0a6664f498fdb89dc71bc3"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"1c7f6991f58507d88ba54aa32e94f31cfd77b1ac","unresolved":false,"context_lines":[{"line_number":100,"context_line":"   since it is by necessity a group of constrained size and some"},{"line_number":101,"context_line":"   of its processes simply can\u0027t be scaled safely.  Finally, the"},{"line_number":102,"context_line":"   results of the review, audit, or threat analysis must"},{"line_number":103,"context_line":"   be published by gerrit review and approval in the \u0027security"},{"line_number":104,"context_line":"   documentaton repository"},{"line_number":105,"context_line":"   http://git.openstack.org/cgit/openstack/security-doc/\u0027__."},{"line_number":106,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9abb7d3a_da24d5c7","line":103,"range":{"start_line":103,"start_character":6,"end_line":103,"end_character":25},"in_reply_to":"9abb7d3a_456680ed","updated":"2016-06-02 17:47:34.000000000","message":"My feeling is that either the OSSP can review and approve (+2+w) or where a third party has been used, the OSSP can review the documentation that the third party created.","commit_id":"9e90bf9949afba655c0a6664f498fdb89dc71bc3"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"be1faa488be9ac1d79963a0cc6c5bcf609011be5","unresolved":false,"context_lines":[{"line_number":100,"context_line":"   since it is by necessity a group of constrained size and some"},{"line_number":101,"context_line":"   of its processes simply can\u0027t be scaled safely.  Finally, the"},{"line_number":102,"context_line":"   results of the review, audit, or threat analysis must"},{"line_number":103,"context_line":"   be published by gerrit review and approval in the \u0027security"},{"line_number":104,"context_line":"   documentaton repository"},{"line_number":105,"context_line":"   http://git.openstack.org/cgit/openstack/security-doc/\u0027__."},{"line_number":106,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9abb7d3a_456680ed","line":103,"range":{"start_line":103,"start_character":6,"end_line":103,"end_character":25},"in_reply_to":"9abb7d3a_639ee157","updated":"2016-06-01 22:24:09.000000000","message":"@Steven,\n\nI think the intent is that the OSSP is agreeing to the document and accepting the TA from the third party (OSSP owns the repo). I agree that the OSSP should not be \"approving\" as the 3rd party.\n\n\nPerhaps the right phrasing is:\n\n\"must be proposed as a gerrit review in the \u0027security documentation repository\u0027 \u003clink here\u003e and accepted by the OpenStack Security Project (OSSP)\"","commit_id":"9e90bf9949afba655c0a6664f498fdb89dc71bc3"},{"author":{"_account_id":9311,"name":"Tristan Cacqueray","email":"tdecacqu@redhat.com","username":"tristanC"},"change_message_id":"742f387871e45b82808c8f4073b32d4deb130360","unresolved":false,"context_lines":[{"line_number":100,"context_line":"   since it is by necessity a group of constrained size and some"},{"line_number":101,"context_line":"   of its processes simply can\u0027t be scaled safely.  Finally, the"},{"line_number":102,"context_line":"   results of the review, audit, or threat analysis must"},{"line_number":103,"context_line":"   be published by gerrit review and approval in the \u0027security"},{"line_number":104,"context_line":"   documentaton repository"},{"line_number":105,"context_line":"   http://git.openstack.org/cgit/openstack/security-doc/\u0027__."},{"line_number":106,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9abb7d3a_d79b0b71","line":103,"range":{"start_line":103,"start_character":6,"end_line":103,"end_character":25},"in_reply_to":"9abb7d3a_74d05dca","updated":"2016-06-02 18:57:20.000000000","message":"+1 to what Morgan and Robert said, I meant \"accept\" (or \"approved\" in gerrit term) simply because they own the repository. I didn\u0027t mean to change who holds responsibility.\n\nWhen the OSSP is acting as the third party, then we can request key member (ptl, core, ...) to +1 the change before it is +w...","commit_id":"9e90bf9949afba655c0a6664f498fdb89dc71bc3"},{"author":{"_account_id":2834,"name":"Steven Dake","email":"steven.dake@gmail.com","username":"sdake"},"change_message_id":"335df87473980c9771e53f76e97de8a0529c26ad","unresolved":false,"context_lines":[{"line_number":100,"context_line":"   since it is by necessity a group of constrained size and some"},{"line_number":101,"context_line":"   of its processes simply can\u0027t be scaled safely.  Finally, the"},{"line_number":102,"context_line":"   results of the review, audit, or threat analysis must"},{"line_number":103,"context_line":"   be published by gerrit review and approval in the \u0027security"},{"line_number":104,"context_line":"   documentaton repository"},{"line_number":105,"context_line":"   http://git.openstack.org/cgit/openstack/security-doc/\u0027__."},{"line_number":106,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9abb7d3a_639ee157","line":103,"range":{"start_line":103,"start_character":6,"end_line":103,"end_character":25},"in_reply_to":"9abb7d3a_a5b61688","updated":"2016-05-28 01:01:15.000000000","message":"I don\u0027t believe we want the OSSP to hold responsibility for approving all reviews, audits, or TAs.  I think what the OSSP wants to be responsible for is helping people with their TAs, and in some cases acting as the 3rd party on the mentioned in this document.  But there could be other third parties beyond the OSSP.\n\nIf the goal is that people publish their documents and they are merged without the OSSP always acting as a 3rd party, I think that makes sense.  The wording you suggest implies the OSSP is always the third party.\n\nNot being Rob, I can\u0027t speak for the security team - and given the holiday (in the US), he may be out since I tried pinging him earlier today to help out with this part of the text.","commit_id":"9e90bf9949afba655c0a6664f498fdb89dc71bc3"},{"author":{"_account_id":2834,"name":"Steven Dake","email":"steven.dake@gmail.com","username":"sdake"},"change_message_id":"95e8de0b5de3356773e625e27731b54f355ff9df","unresolved":false,"context_lines":[{"line_number":100,"context_line":"   since it is by necessity a group of constrained size and some"},{"line_number":101,"context_line":"   of its processes simply can\u0027t be scaled safely.  Finally, the"},{"line_number":102,"context_line":"   results of the review, audit, or threat analysis must"},{"line_number":103,"context_line":"   be published by gerrit review and approval in the \u0027security"},{"line_number":104,"context_line":"   documentaton repository"},{"line_number":105,"context_line":"   http://git.openstack.org/cgit/openstack/security-doc/\u0027__."},{"line_number":106,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9abb7d3a_9204e4c6","line":103,"range":{"start_line":103,"start_character":6,"end_line":103,"end_character":25},"in_reply_to":"9abb7d3a_d79b0b71","updated":"2016-06-03 00:10:02.000000000","message":"Thanks for the comments folks.  They really helped me formulate the proper language.  The difference between accept and approve is super subtle, so I added hard guidance in addition.","commit_id":"9e90bf9949afba655c0a6664f498fdb89dc71bc3"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"cf744b387e6e9866a0c1a014ac9148efb303ba9b","unresolved":false,"context_lines":[{"line_number":100,"context_line":"   since it is by necessity a group of constrained size and some"},{"line_number":101,"context_line":"   of its processes simply can\u0027t be scaled safely.  Finally, the"},{"line_number":102,"context_line":"   results of the review, audit, or threat analysis must"},{"line_number":103,"context_line":"   be published by gerrit review and approval in the \u0027security"},{"line_number":104,"context_line":"   documentaton repository"},{"line_number":105,"context_line":"   http://git.openstack.org/cgit/openstack/security-doc/\u0027__."},{"line_number":106,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9abb7d3a_74d05dca","line":103,"range":{"start_line":103,"start_character":6,"end_line":103,"end_character":25},"in_reply_to":"9abb7d3a_da24d5c7","updated":"2016-06-02 18:38:25.000000000","message":"@Robert,\n\nThat is the intention of my change of \"approve\" to \"accept\" verbiage.\n\nI do think it could also be considered fine as is (personally).","commit_id":"9e90bf9949afba655c0a6664f498fdb89dc71bc3"},{"author":{"_account_id":2834,"name":"Steven Dake","email":"steven.dake@gmail.com","username":"sdake"},"change_message_id":"ee58a9b103727429c26da77542dfe88b2734eb94","unresolved":false,"context_lines":[{"line_number":100,"context_line":"   since it is by necessity a group of constrained size and some"},{"line_number":101,"context_line":"   of its processes simply can\u0027t be scaled safely.  Finally, the"},{"line_number":102,"context_line":"   results of the review, audit, or threat analysis must"},{"line_number":103,"context_line":"   be proposed as a gerrit review in the \u0027security documentation repository\u0027"},{"line_number":104,"context_line":"   http://git.openstack.org/cgit/openstack/security-doc/\u0027__."},{"line_number":105,"context_line":"   and accepted by the OpenStack Security Project (OSSP).  Acceptance"},{"line_number":106,"context_line":"   by the OpenStack Security Project (OSSP) of the documentation does"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_32aa5871","line":103,"updated":"2016-06-03 00:16:38.000000000","message":"Robert,\n\nIs this the correct repository, or would you like me to add a security-analysis repository, set it up in project-config, and make it a dependency of this change and submit a governance repository change to add security-analysis to the list of managed deliverables by the OSSP?\n\nTIA","commit_id":"97201807318c756d74e7ee06c56716ba4200fe0f"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"d81b4f9ae4c212662558acadf866da12eb9478d3","unresolved":false,"context_lines":[{"line_number":104,"context_line":"   http://git.openstack.org/cgit/openstack/security-doc/\u0027__."},{"line_number":105,"context_line":"   and accepted by the OpenStack Security Project (OSSP).  Acceptance"},{"line_number":106,"context_line":"   by the OpenStack Security Project (OSSP) of the documentation does"},{"line_number":107,"context_line":"   not constitute a third party approval unless the OpenStack Securityi"},{"line_number":108,"context_line":"   Project(OSSP) agrees in advance to acting as a third party approver."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"6. All repos for the deliverable covered should have automated"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abb7d3a_907217ac","line":107,"updated":"2016-06-03 04:13:41.000000000","message":"typo *Security","commit_id":"97201807318c756d74e7ee06c56716ba4200fe0f"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"bf535c7f6003f8b813d6ed3a3d5e67fbe7a4cdd8","unresolved":false,"context_lines":[{"line_number":101,"context_line":"   of its processes simply can\u0027t be scaled safely.  Finally, the"},{"line_number":102,"context_line":"   results of the review, audit, or threat analysis must"},{"line_number":103,"context_line":"   be proposed as a gerrit review in the \u0027security documentation repository\u0027"},{"line_number":104,"context_line":"   http://git.openstack.org/cgit/openstack/security-doc/\u0027__."},{"line_number":105,"context_line":"   and accepted by the OpenStack Security Project (OSSP).  Acceptance"},{"line_number":106,"context_line":"   by the OpenStack Security Project (OSSP) of the documentation does"},{"line_number":107,"context_line":"   not constitute a third party approval unless the OpenStack Security"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9abb7d3a_30becbff","line":104,"updated":"2016-06-03 04:18:48.000000000","message":"let\u0027s put it in a separate repo: security-analysis as purposed on IRC","commit_id":"eb9f4be1673b30289a40d30128ecbf6439fd355b"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"2c1ec95e9429d39c3e8c3b48b3fb06174498200d","unresolved":false,"context_lines":[{"line_number":102,"context_line":"   results of the review, audit, or threat analysis must"},{"line_number":103,"context_line":"   be proposed as a gerrit review in the \u0027security documentation repository\u0027"},{"line_number":104,"context_line":"   http://git.openstack.org/cgit/openstack/security-doc/\u0027__."},{"line_number":105,"context_line":"   and accepted by the OpenStack Security Project (OSSP).  Acceptance"},{"line_number":106,"context_line":"   by the OpenStack Security Project (OSSP) of the documentation does"},{"line_number":107,"context_line":"   not constitute a third party approval unless the OpenStack Security"},{"line_number":108,"context_line":"   Project(OSSP) agrees in advance to acting as a third party approver."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"6. All repos for the deliverable covered should have automated"},{"line_number":111,"context_line":"   testing for important features. Tests need to be feasible for the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9abb7d3a_5a78ce8f","line":108,"range":{"start_line":105,"start_character":59,"end_line":108,"end_character":70},"updated":"2016-06-03 02:50:27.000000000","message":"I think this clearly defines the intent. Thanks for the hard work on it.\n\nI do like the new verbiage a lot. Well done.","commit_id":"eb9f4be1673b30289a40d30128ecbf6439fd355b"}]}