)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"16d4c7910d5fa42c42829a24dc57d91ba33d8eb8","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"041ddaaf_2bbf1dab","updated":"2026-08-06 15:56:22.000000000","message":"A few comments inline.","commit_id":"e0dccc180d1eac223f6254b43052a6015038606e"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"866713fbadbf024285b732e336ed8546f4b04f61","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"a38b03c2_656f2f00","updated":"2026-08-06 22:30:38.000000000","message":"Thank you for the comments, addressing them shortly","commit_id":"e0dccc180d1eac223f6254b43052a6015038606e"}],"doc/source/project-maintainer-guide.rst":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"983de630f8a8188094539a57cc90d8f817a9a219","unresolved":true,"context_lines":[{"line_number":13,"context_line":"For the VMT\u0027s own internal process, see :doc:`vmt-process`."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Setting Up Your Project"},{"line_number":16,"context_line":"-----------------------"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"These steps are required for VMT oversight. See"},{"line_number":19,"context_line":":ref:`repositories overseen` for full requirements and the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"db3ed60a_b6cfb456","line":16,"updated":"2026-08-05 19:32:24.000000000","message":"Suggestion - Split this into two portions:\n- \"Initial Setup\"\n  - Create coresec team\n  - Configure bug tracker sharing\n- \"Recurring maintenance\" (maybe suggest reviewing this per cycle)\n  - Coresec membership\n  - Security liason","commit_id":"e0dccc180d1eac223f6254b43052a6015038606e"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"866713fbadbf024285b732e336ed8546f4b04f61","unresolved":true,"context_lines":[{"line_number":13,"context_line":"For the VMT\u0027s own internal process, see :doc:`vmt-process`."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Setting Up Your Project"},{"line_number":16,"context_line":"-----------------------"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"These steps are required for VMT oversight. See"},{"line_number":19,"context_line":":ref:`repositories overseen` for full requirements and the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"c8837629_9d295fb1","line":16,"in_reply_to":"253d01bb_caf22486","updated":"2026-08-06 22:30:38.000000000","message":"Ack, will do.","commit_id":"e0dccc180d1eac223f6254b43052a6015038606e"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"a407bd739bf488ee38497cff162018c73f80d0e3","unresolved":false,"context_lines":[{"line_number":13,"context_line":"For the VMT\u0027s own internal process, see :doc:`vmt-process`."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Setting Up Your Project"},{"line_number":16,"context_line":"-----------------------"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"These steps are required for VMT oversight. See"},{"line_number":19,"context_line":":ref:`repositories overseen` for full requirements and the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"17611b64_d7e9cfd4","line":16,"in_reply_to":"c8837629_9d295fb1","updated":"2026-08-06 22:40:44.000000000","message":"Done","commit_id":"e0dccc180d1eac223f6254b43052a6015038606e"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"16d4c7910d5fa42c42829a24dc57d91ba33d8eb8","unresolved":true,"context_lines":[{"line_number":13,"context_line":"For the VMT\u0027s own internal process, see :doc:`vmt-process`."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Setting Up Your Project"},{"line_number":16,"context_line":"-----------------------"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"These steps are required for VMT oversight. See"},{"line_number":19,"context_line":":ref:`repositories overseen` for full requirements and the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"253d01bb_caf22486","line":16,"in_reply_to":"db3ed60a_b6cfb456","updated":"2026-08-06 15:56:22.000000000","message":"Agree with Jay, this is a good idea.","commit_id":"e0dccc180d1eac223f6254b43052a6015038606e"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"16d4c7910d5fa42c42829a24dc57d91ba33d8eb8","unresolved":true,"context_lines":[{"line_number":47,"context_line":"When a Bug Is Reported"},{"line_number":48,"context_line":"----------------------"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"A reporter has gone through the effort of disclosing responsibly."},{"line_number":51,"context_line":"Treat every report with the attention it deserves."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"1. The VMT triages every private security bug filed against"}],"source_content_type":"text/x-rst","patch_set":1,"id":"4679e0d0_964e83e4","line":50,"range":{"start_line":50,"start_character":0,"end_line":50,"end_character":65},"updated":"2026-08-06 15:56:22.000000000","message":"how about:\nThe reporter has taken extra care to make a responsible disclosure of an issue that may impact a large segment of the OpenStack user base.","commit_id":"e0dccc180d1eac223f6254b43052a6015038606e"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"866713fbadbf024285b732e336ed8546f4b04f61","unresolved":true,"context_lines":[{"line_number":47,"context_line":"When a Bug Is Reported"},{"line_number":48,"context_line":"----------------------"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"A reporter has gone through the effort of disclosing responsibly."},{"line_number":51,"context_line":"Treat every report with the attention it deserves."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"1. The VMT triages every private security bug filed against"}],"source_content_type":"text/x-rst","patch_set":1,"id":"f55df4bc_adae58ed","line":50,"range":{"start_line":50,"start_character":0,"end_line":50,"end_character":65},"in_reply_to":"4679e0d0_964e83e4","updated":"2026-08-06 22:30:38.000000000","message":"ack","commit_id":"e0dccc180d1eac223f6254b43052a6015038606e"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"a407bd739bf488ee38497cff162018c73f80d0e3","unresolved":false,"context_lines":[{"line_number":47,"context_line":"When a Bug Is Reported"},{"line_number":48,"context_line":"----------------------"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"A reporter has gone through the effort of disclosing responsibly."},{"line_number":51,"context_line":"Treat every report with the attention it deserves."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"1. The VMT triages every private security bug filed against"}],"source_content_type":"text/x-rst","patch_set":1,"id":"e013f866_81eb28ff","line":50,"range":{"start_line":50,"start_character":0,"end_line":50,"end_character":65},"in_reply_to":"f55df4bc_adae58ed","updated":"2026-08-06 22:40:44.000000000","message":"Done","commit_id":"e0dccc180d1eac223f6254b43052a6015038606e"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"983de630f8a8188094539a57cc90d8f817a9a219","unresolved":true,"context_lines":[{"line_number":63,"context_line":"   maintained stable branches contain that code. The VMT needs"},{"line_number":64,"context_line":"   the earliest affected version (full history, not just currently"},{"line_number":65,"context_line":"   supported branches) and the version ranges for the OSSA and"},{"line_number":66,"context_line":"   CVE request."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"4. **Classify.** Work with the VMT to assign a class per the"},{"line_number":69,"context_line":"   :ref:`incident report taxonomy`. The classification determines"}],"source_content_type":"text/x-rst","patch_set":1,"id":"34de54be_3ba9aa52","line":66,"range":{"start_line":66,"start_character":0,"end_line":66,"end_character":15},"updated":"2026-08-05 19:32:24.000000000","message":"Writing the versions impacted is a really confusing process, and while I understand simplifying it here, if we really want to remove the need for a human-conversation, we\u0027ll need a more in-depth explanation -- maybe even with examples.","commit_id":"e0dccc180d1eac223f6254b43052a6015038606e"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"866713fbadbf024285b732e336ed8546f4b04f61","unresolved":true,"context_lines":[{"line_number":63,"context_line":"   maintained stable branches contain that code. The VMT needs"},{"line_number":64,"context_line":"   the earliest affected version (full history, not just currently"},{"line_number":65,"context_line":"   supported branches) and the version ranges for the OSSA and"},{"line_number":66,"context_line":"   CVE request."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"4. **Classify.** Work with the VMT to assign a class per the"},{"line_number":69,"context_line":"   :ref:`incident report taxonomy`. The classification determines"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7fb7d8b6_842a7c54","line":66,"range":{"start_line":66,"start_character":0,"end_line":66,"end_character":15},"in_reply_to":"34de54be_3ba9aa52","updated":"2026-08-06 22:30:38.000000000","message":"That\u0027s a good idea. I\u0027ll expand on this.","commit_id":"e0dccc180d1eac223f6254b43052a6015038606e"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"a407bd739bf488ee38497cff162018c73f80d0e3","unresolved":false,"context_lines":[{"line_number":63,"context_line":"   maintained stable branches contain that code. The VMT needs"},{"line_number":64,"context_line":"   the earliest affected version (full history, not just currently"},{"line_number":65,"context_line":"   supported branches) and the version ranges for the OSSA and"},{"line_number":66,"context_line":"   CVE request."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"4. **Classify.** Work with the VMT to assign a class per the"},{"line_number":69,"context_line":"   :ref:`incident report taxonomy`. The classification determines"}],"source_content_type":"text/x-rst","patch_set":1,"id":"38b086a6_e8fd1155","line":66,"range":{"start_line":66,"start_character":0,"end_line":66,"end_character":15},"in_reply_to":"7fb7d8b6_842a7c54","updated":"2026-08-06 22:40:44.000000000","message":"Done","commit_id":"e0dccc180d1eac223f6254b43052a6015038606e"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"983de630f8a8188094539a57cc90d8f817a9a219","unresolved":true,"context_lines":[{"line_number":72,"context_line":"Developing the Fix"},{"line_number":73,"context_line":"------------------"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"For embargoed (Class A) vulnerabilities:"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"1. **All discussion stays on the private bug.** Do not mention the"},{"line_number":78,"context_line":"   vulnerability in any public or untrusted forum: IRC channels,"}],"source_content_type":"text/x-rst","patch_set":1,"id":"d5f9ce6a_85048ca1","line":75,"updated":"2026-08-05 19:32:24.000000000","message":"-1 for this specifically: Not all Class A vulnerabilities are embargoed.\n\nI\u0027d specifically suggest maybe even mentioning it here. A \"Evaluating a private bug\" section, indicating that you should help VMT pick a class from the taxonomy, and that if it\u0027s Class A, you have an additional decision: is the pain/effort/time cost of coordinating disclosure worth it or not. I think we could include some useful things to consider in that section to (e.g.: is the feature enabled by default? Does the impacted feature impact cloud hosters in a particularly negative way? Is there a workaround in the iterim)","commit_id":"e0dccc180d1eac223f6254b43052a6015038606e"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"a407bd739bf488ee38497cff162018c73f80d0e3","unresolved":false,"context_lines":[{"line_number":72,"context_line":"Developing the Fix"},{"line_number":73,"context_line":"------------------"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"For embargoed (Class A) vulnerabilities:"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"1. **All discussion stays on the private bug.** Do not mention the"},{"line_number":78,"context_line":"   vulnerability in any public or untrusted forum: IRC channels,"}],"source_content_type":"text/x-rst","patch_set":1,"id":"c8d71a1f_541ede6f","line":75,"in_reply_to":"3cbbd3b6_86bd11aa","updated":"2026-08-06 22:40:44.000000000","message":"Done","commit_id":"e0dccc180d1eac223f6254b43052a6015038606e"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"866713fbadbf024285b732e336ed8546f4b04f61","unresolved":true,"context_lines":[{"line_number":72,"context_line":"Developing the Fix"},{"line_number":73,"context_line":"------------------"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"For embargoed (Class A) vulnerabilities:"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"1. **All discussion stays on the private bug.** Do not mention the"},{"line_number":78,"context_line":"   vulnerability in any public or untrusted forum: IRC channels,"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3cbbd3b6_86bd11aa","line":75,"in_reply_to":"d5f9ce6a_85048ca1","updated":"2026-08-06 22:30:38.000000000","message":"True","commit_id":"e0dccc180d1eac223f6254b43052a6015038606e"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"16d4c7910d5fa42c42829a24dc57d91ba33d8eb8","unresolved":true,"context_lines":[{"line_number":84,"context_line":"   Launchpad bug as files. Coordinate with the VMT before making"},{"line_number":85,"context_line":"   anything public."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"3. **Prepare patches for all branches.** Create patches for master and every"},{"line_number":88,"context_line":"   maintained stable branch. Use ``git format-patch`` to generate"},{"line_number":89,"context_line":"   them."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"4. **Test locally.** CI cannot be used under embargo. Run unit"}],"source_content_type":"text/x-rst","patch_set":1,"id":"e521184d_e87c9172","line":88,"range":{"start_line":87,"start_character":71,"end_line":88,"end_character":13},"updated":"2026-08-06 15:56:22.000000000","message":"every applicable maintained","commit_id":"e0dccc180d1eac223f6254b43052a6015038606e"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"a407bd739bf488ee38497cff162018c73f80d0e3","unresolved":false,"context_lines":[{"line_number":84,"context_line":"   Launchpad bug as files. Coordinate with the VMT before making"},{"line_number":85,"context_line":"   anything public."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"3. **Prepare patches for all branches.** Create patches for master and every"},{"line_number":88,"context_line":"   maintained stable branch. Use ``git format-patch`` to generate"},{"line_number":89,"context_line":"   them."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"4. **Test locally.** CI cannot be used under embargo. Run unit"}],"source_content_type":"text/x-rst","patch_set":1,"id":"984033c7_618ae623","line":88,"range":{"start_line":87,"start_character":71,"end_line":88,"end_character":13},"in_reply_to":"530a01cd_cddb648c","updated":"2026-08-06 22:40:44.000000000","message":"Done","commit_id":"e0dccc180d1eac223f6254b43052a6015038606e"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"866713fbadbf024285b732e336ed8546f4b04f61","unresolved":true,"context_lines":[{"line_number":84,"context_line":"   Launchpad bug as files. Coordinate with the VMT before making"},{"line_number":85,"context_line":"   anything public."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"3. **Prepare patches for all branches.** Create patches for master and every"},{"line_number":88,"context_line":"   maintained stable branch. Use ``git format-patch`` to generate"},{"line_number":89,"context_line":"   them."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"4. **Test locally.** CI cannot be used under embargo. Run unit"}],"source_content_type":"text/x-rst","patch_set":1,"id":"530a01cd_cddb648c","line":88,"range":{"start_line":87,"start_character":71,"end_line":88,"end_character":13},"in_reply_to":"e521184d_e87c9172","updated":"2026-08-06 22:30:38.000000000","message":"++","commit_id":"e0dccc180d1eac223f6254b43052a6015038606e"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"16d4c7910d5fa42c42829a24dc57d91ba33d8eb8","unresolved":true,"context_lines":[{"line_number":106,"context_line":"2. **Agree on a disclosure date.** The VMT will propose dates"},{"line_number":107,"context_line":"   (Tuesday, Wednesday, or Thursday at 1500 UTC). Pick a date"},{"line_number":108,"context_line":"   when you and at least one other core reviewer will be"},{"line_number":109,"context_line":"   available."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"3. The VMT sends a downstream stakeholder notification with the"},{"line_number":112,"context_line":"   patches attached. You can request a copy for your records."}],"source_content_type":"text/x-rst","patch_set":1,"id":"c3e2e13d_763a5d3b","line":109,"updated":"2026-08-06 15:56:22.000000000","message":"add to point 2: Make sure that you or the other core reviewer have approval permission on the stable branches.","commit_id":"e0dccc180d1eac223f6254b43052a6015038606e"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"a407bd739bf488ee38497cff162018c73f80d0e3","unresolved":false,"context_lines":[{"line_number":106,"context_line":"2. **Agree on a disclosure date.** The VMT will propose dates"},{"line_number":107,"context_line":"   (Tuesday, Wednesday, or Thursday at 1500 UTC). Pick a date"},{"line_number":108,"context_line":"   when you and at least one other core reviewer will be"},{"line_number":109,"context_line":"   available."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"3. The VMT sends a downstream stakeholder notification with the"},{"line_number":112,"context_line":"   patches attached. You can request a copy for your records."}],"source_content_type":"text/x-rst","patch_set":1,"id":"9c296495_8e41bcb9","line":109,"in_reply_to":"b69ffe7c_c013a4ae","updated":"2026-08-06 22:40:44.000000000","message":"Done","commit_id":"e0dccc180d1eac223f6254b43052a6015038606e"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"866713fbadbf024285b732e336ed8546f4b04f61","unresolved":true,"context_lines":[{"line_number":106,"context_line":"2. **Agree on a disclosure date.** The VMT will propose dates"},{"line_number":107,"context_line":"   (Tuesday, Wednesday, or Thursday at 1500 UTC). Pick a date"},{"line_number":108,"context_line":"   when you and at least one other core reviewer will be"},{"line_number":109,"context_line":"   available."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"3. The VMT sends a downstream stakeholder notification with the"},{"line_number":112,"context_line":"   patches attached. You can request a copy for your records."}],"source_content_type":"text/x-rst","patch_set":1,"id":"b69ffe7c_c013a4ae","line":109,"in_reply_to":"c3e2e13d_763a5d3b","updated":"2026-08-06 22:30:38.000000000","message":"ah, meaningful distinction, will add that","commit_id":"e0dccc180d1eac223f6254b43052a6015038606e"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"983de630f8a8188094539a57cc90d8f817a9a219","unresolved":true,"context_lines":[{"line_number":130,"context_line":"3. **Fast-track review and merge.** The patches have already been"},{"line_number":131,"context_line":"   reviewed on the bug. Approve and merge promptly."},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"4. **Review the OSSA** that the VMT publishes for accuracy."},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"After Disclosure"},{"line_number":136,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"cb40786e_b4d14a9b","line":133,"updated":"2026-08-05 19:32:24.000000000","message":"Maybe specifically mention here: \"Update the OSSA with the URLs in Gerrit, which you now have\".","commit_id":"e0dccc180d1eac223f6254b43052a6015038606e"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"a407bd739bf488ee38497cff162018c73f80d0e3","unresolved":false,"context_lines":[{"line_number":130,"context_line":"3. **Fast-track review and merge.** The patches have already been"},{"line_number":131,"context_line":"   reviewed on the bug. Approve and merge promptly."},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"4. **Review the OSSA** that the VMT publishes for accuracy."},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"After Disclosure"},{"line_number":136,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"f2ac3d18_e3b142cd","line":133,"in_reply_to":"49b9d660_074c816d","updated":"2026-08-06 22:40:44.000000000","message":"Added a note about gerrit URLs","commit_id":"e0dccc180d1eac223f6254b43052a6015038606e"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"16d4c7910d5fa42c42829a24dc57d91ba33d8eb8","unresolved":true,"context_lines":[{"line_number":130,"context_line":"3. **Fast-track review and merge.** The patches have already been"},{"line_number":131,"context_line":"   reviewed on the bug. Approve and merge promptly."},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"4. **Review the OSSA** that the VMT publishes for accuracy."},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"After Disclosure"},{"line_number":136,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"f6525142_889d8f03","line":133,"in_reply_to":"cb40786e_b4d14a9b","updated":"2026-08-06 15:56:22.000000000","message":"Isn\u0027t this more a task for the owner of the OSSA patch (who is probably a VMT person?)?","commit_id":"e0dccc180d1eac223f6254b43052a6015038606e"},{"author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"change_message_id":"866713fbadbf024285b732e336ed8546f4b04f61","unresolved":true,"context_lines":[{"line_number":130,"context_line":"3. **Fast-track review and merge.** The patches have already been"},{"line_number":131,"context_line":"   reviewed on the bug. Approve and merge promptly."},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"4. **Review the OSSA** that the VMT publishes for accuracy."},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"After Disclosure"},{"line_number":136,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"49b9d660_074c816d","line":133,"in_reply_to":"f6525142_889d8f03","updated":"2026-08-06 22:30:38.000000000","message":"Yes, it is.. typically the VMT writes the OSSA; not opposed to others doing it too.. but when they do, I would hope someone else from the project cross-checks.","commit_id":"e0dccc180d1eac223f6254b43052a6015038606e"},{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"9c0800b36be82aaec5f68a68b6dbd47c661b2cd3","unresolved":false,"context_lines":[{"line_number":16,"context_line":"-------------"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"These steps are required for VMT oversight. See"},{"line_number":19,"context_line":":ref:`repositories overseen` for full requirements and the"},{"line_number":20,"context_line":"`project tracker configuration guide`_ for Launchpad setup."},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"1. **Create a coresec team.** Register a ``{project}-coresec``"}],"source_content_type":"text/x-rst","patch_set":3,"id":"535c39b8_3c006581","line":19,"updated":"2026-09-28 21:40:43.000000000","message":"Aside: In the future we could consider moving that document here and just redirect it or leave a breadcrumb.","commit_id":"c61a1c7a521fc8be9d880b4dfb69dabd34858f91"},{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"9c0800b36be82aaec5f68a68b6dbd47c661b2cd3","unresolved":false,"context_lines":[{"line_number":20,"context_line":"`project tracker configuration guide`_ for Launchpad setup."},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"1. **Create a coresec team.** Register a ``{project}-coresec``"},{"line_number":23,"context_line":"   group in Launchpad. This is the small circle of core reviewers"},{"line_number":24,"context_line":"   who will see private security bugs and review embargoed patches."},{"line_number":25,"context_line":"   Keep this group small: only people who need to confirm, fix, and"},{"line_number":26,"context_line":"   review the vulnerability."}],"source_content_type":"text/x-rst","patch_set":3,"id":"e9db5486_ca44e506","line":23,"updated":"2026-09-28 21:40:43.000000000","message":"Nit: Not always core reviewers, but maybe it\u0027s okay to elide the more complicated explanation here since we are precise about it in the overseen doc linked above.","commit_id":"c61a1c7a521fc8be9d880b4dfb69dabd34858f91"},{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"9c0800b36be82aaec5f68a68b6dbd47c661b2cd3","unresolved":false,"context_lines":[{"line_number":26,"context_line":"   review the vulnerability."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"2. **Configure bug tracker sharing.** Private security bugs must"},{"line_number":29,"context_line":"   be visible only to the VMT. Configure your project\u0027s Launchpad"},{"line_number":30,"context_line":"   sharing settings so that ``Private Security`` bugs are shared"},{"line_number":31,"context_line":"   with the VMT and no one else. The VMT will add your coresec"},{"line_number":32,"context_line":"   group after initial triage."}],"source_content_type":"text/x-rst","patch_set":3,"id":"477435b1_e1485fba","line":29,"updated":"2026-09-28 21:40:43.000000000","message":"Nit: Similar to the above, this could get confusing. It\u0027s the \"*all* private security\" setting we want exclusive to the VMT, but the sharing page will also call out that \"*some* private security\" bugs are shared with other teams and individuals. And then there\u0027s also \"private\" (non-security) bugs in there... I guess it\u0027s okay to leave this to the Project Tracker Management document to get into specifics? (Though it\u0027s a little vague on some of these points as well.)","commit_id":"c61a1c7a521fc8be9d880b4dfb69dabd34858f91"},{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"12532c5d3c44f2174fd347ddcaab158f08573286","unresolved":false,"context_lines":[{"line_number":43,"context_line":"2. **Designate a security liaison.** Identify one person as the"},{"line_number":44,"context_line":"   VMT\u0027s escalation point. If not explicitly designated, the PTL"},{"line_number":45,"context_line":"   is the implicit liaison. Record your liaison in your project\u0027s"},{"line_number":46,"context_line":"   entry in `projects.yaml`_ in the governance repository."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":".. _project tracker configuration guide: https://docs.openstack.org/project-team-guide/project-trackers.html"},{"line_number":49,"context_line":".. _projects.yaml: https://opendev.org/openstack/governance/src/branch/master/reference/projects.yaml"}],"source_content_type":"text/x-rst","patch_set":3,"id":"ae4f01e8_b7b9a725","line":46,"updated":"2026-09-28 22:29:56.000000000","message":"Nit: Could call out that it\u0027s already mandatory for DPL teams.","commit_id":"c61a1c7a521fc8be9d880b4dfb69dabd34858f91"},{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"12532c5d3c44f2174fd347ddcaab158f08573286","unresolved":false,"context_lines":[{"line_number":56,"context_line":"base. Treat every report with the attention it deserves."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"1. The VMT triages every private security bug filed against"},{"line_number":59,"context_line":"   OpenStack projects. The VMT will subscribe your coresec team"},{"line_number":60,"context_line":"   and post an initial triage comment."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"2. **Reproduce and confirm.** Verify that the reported behavior"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7ac81283_26aa9dff","line":59,"updated":"2026-09-28 22:29:56.000000000","message":"Nit: In other places we refer to it as a security review team, in order not to ascribe any special meaning to the common team suffix in LP and to avoid implying that they\u0027re always made up entirely of core reviewers.","commit_id":"c61a1c7a521fc8be9d880b4dfb69dabd34858f91"},{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"12532c5d3c44f2174fd347ddcaab158f08573286","unresolved":false,"context_lines":[{"line_number":64,"context_line":"   details of your test environment."},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"3. **Identify affected versions.** This is critical. Determine"},{"line_number":67,"context_line":"   the commit that first introduced the vulnerability, and which"},{"line_number":68,"context_line":"   maintained stable branches contain that code. The VMT needs"},{"line_number":69,"context_line":"   the earliest affected version (full history, not just currently"},{"line_number":70,"context_line":"   supported branches) and the version ranges for the OSSA and"}],"source_content_type":"text/x-rst","patch_set":3,"id":"94a60a69_ecbcdf3f","line":67,"updated":"2026-09-28 22:29:56.000000000","message":"Nit: Prior to determination of report class, we try to avoid referring to reports as vulnerabilities, instead calling them \"reports,\" \"defects\" or \"suspected vulnerabilities.\"","commit_id":"c61a1c7a521fc8be9d880b4dfb69dabd34858f91"},{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"12532c5d3c44f2174fd347ddcaab158f08573286","unresolved":false,"context_lines":[{"line_number":76,"context_line":"   (current version ``26.0.1``) and ``stable/2025.2`` (current"},{"line_number":77,"context_line":"   version ``27.0.0``), the affected versions string would be:"},{"line_number":78,"context_line":"   ``\u003e\u003d12.0.0 \u003c26.0.2, \u003e\u003d27.0.0 \u003c27.0.1``. See the"},{"line_number":79,"context_line":"   :doc:`vmt-process` for full conventions on version ranges."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"4. **Classify.** Work with the VMT to assign a class per the"},{"line_number":82,"context_line":"   :ref:`incident report taxonomy`. The classification determines"}],"source_content_type":"text/x-rst","patch_set":3,"id":"e05eb94c_00732191","line":79,"updated":"2026-09-28 22:29:56.000000000","message":"Nit: Sometimes defects get backported too, so the commit which introduced it may not be on the oldest branch. It may help to call that out.","commit_id":"c61a1c7a521fc8be9d880b4dfb69dabd34858f91"},{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"12532c5d3c44f2174fd347ddcaab158f08573286","unresolved":false,"context_lines":[{"line_number":78,"context_line":"   ``\u003e\u003d12.0.0 \u003c26.0.2, \u003e\u003d27.0.0 \u003c27.0.1``. See the"},{"line_number":79,"context_line":"   :doc:`vmt-process` for full conventions on version ranges."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"4. **Classify.** Work with the VMT to assign a class per the"},{"line_number":82,"context_line":"   :ref:`incident report taxonomy`. The classification determines"},{"line_number":83,"context_line":"   the outcome (OSSA, OSSN, or public fix)."},{"line_number":84,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"c19fa74f_5ba41d60","line":81,"updated":"2026-09-28 22:29:56.000000000","message":"Nit: It may make more sense to swap this and #3, since the work of determining affected versions is unnecessary (from the VMT\u0027s perspective) if we\u0027re not going to publish anything about it anyway.","commit_id":"c61a1c7a521fc8be9d880b4dfb69dabd34858f91"}]}