)]}'
{"doc/source/index.rst":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"d59b0e40026ba299fda0e8764caff2615a5494af","unresolved":true,"context_lines":[{"line_number":35,"context_line":"upstream to the OpenStack community as described below. For actively exploited"},{"line_number":36,"context_line":"vulnerabilities and severe incidents that may require CRA escalation,"},{"line_number":37,"context_line":"OpenStack\u0027s Vulnerability Managament Team will handle coordination with the"},{"line_number":38,"context_line":"steward."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"How to report security issues to OpenStack"}],"source_content_type":"text/x-rst","patch_set":3,"id":"cf9310b0_c623389e","line":38,"updated":"2026-09-02 18:29:34.000000000","message":"Does this really need top billing? Can we add this to the end as a new section, under regulatory information or something?","commit_id":"22d1458a66cacc6b0dcdbb8a8deda4ed509b8b79"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"99dcaec1fcd8ee4cb82fc9a678a8f200924d852c","unresolved":true,"context_lines":[{"line_number":35,"context_line":"upstream to the OpenStack community as described below. For actively exploited"},{"line_number":36,"context_line":"vulnerabilities and severe incidents that may require CRA escalation,"},{"line_number":37,"context_line":"OpenStack\u0027s Vulnerability Managament Team will handle coordination with the"},{"line_number":38,"context_line":"steward."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"How to report security issues to OpenStack"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1c0986d7_6a629980","line":38,"in_reply_to":"0beca1fe_8daeb17d","updated":"2026-10-12 18:34:49.000000000","message":"Yeah I want it below the fold for exactly that reason: this info is useful for people who want knowledge about CRA, and is harmful for almost every other purpose. So hide it 😉","commit_id":"22d1458a66cacc6b0dcdbb8a8deda4ed509b8b79"},{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"446a5ad63052c5dc0bfecd72b23576498dd1d5fe","unresolved":true,"context_lines":[{"line_number":35,"context_line":"upstream to the OpenStack community as described below. For actively exploited"},{"line_number":36,"context_line":"vulnerabilities and severe incidents that may require CRA escalation,"},{"line_number":37,"context_line":"OpenStack\u0027s Vulnerability Managament Team will handle coordination with the"},{"line_number":38,"context_line":"steward."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"How to report security issues to OpenStack"}],"source_content_type":"text/x-rst","patch_set":3,"id":"2a68d7dd_d2f7822f","line":38,"in_reply_to":"1c0986d7_6a629980","updated":"2026-10-12 19:13:16.000000000","message":"Yes, LF Legal wants every project to have a security file with this statement as its very first sentence. I disagree and am happy to push back, but want to at least find a middle-ground compromise to keep it easily discoverable.","commit_id":"22d1458a66cacc6b0dcdbb8a8deda4ed509b8b79"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"6de518e5fac8cec7291d852f7cce50b0b1ccf5eb","unresolved":true,"context_lines":[{"line_number":35,"context_line":"upstream to the OpenStack community as described below. For actively exploited"},{"line_number":36,"context_line":"vulnerabilities and severe incidents that may require CRA escalation,"},{"line_number":37,"context_line":"OpenStack\u0027s Vulnerability Managament Team will handle coordination with the"},{"line_number":38,"context_line":"steward."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"How to report security issues to OpenStack"}],"source_content_type":"text/x-rst","patch_set":3,"id":"8960d3bb_83bfd91a","line":38,"in_reply_to":"2a68d7dd_d2f7822f","updated":"2026-10-12 20:14:09.000000000","message":"This still has \"Regulatory Compliance\" as a section near the top. Can we move it to the bottom? I am -1 to it getting billing over OSSAs and OSSNs, at a minimum.","commit_id":"22d1458a66cacc6b0dcdbb8a8deda4ed509b8b79"},{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"fce854cf9345da86892fe60a6b40053606c2d034","unresolved":true,"context_lines":[{"line_number":35,"context_line":"upstream to the OpenStack community as described below. For actively exploited"},{"line_number":36,"context_line":"vulnerabilities and severe incidents that may require CRA escalation,"},{"line_number":37,"context_line":"OpenStack\u0027s Vulnerability Managament Team will handle coordination with the"},{"line_number":38,"context_line":"steward."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"How to report security issues to OpenStack"}],"source_content_type":"text/x-rst","patch_set":3,"id":"0beca1fe_8daeb17d","line":38,"in_reply_to":"cf9310b0_c623389e","updated":"2026-10-12 13:29:16.000000000","message":"I suppose putting it in a dedicated section immediately following the \"how to report\" section would still make it fairly obvious to manufacturers trying to understand that they should continue to report issues directly upstream and not to our steward. I\u0027m trying to find a compromise to satisfy LF\u0027s requirement that all projects declare them a steward (I think publication of this guidance has been put on hold following the EC\u0027s clarification that steward responsibilities don\u0027t go into effect until the end of 2027).","commit_id":"22d1458a66cacc6b0dcdbb8a8deda4ed509b8b79"}]}