[Bug 40527] New: Add SECURITY.md to Koha
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40527 Bug ID: 40527 Summary: Add SECURITY.md to Koha Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: dcook@prosentient.com.au QA Contact: testopia@bugs.koha-community.org We should consider adding a SECURITY.md document to the Koha git repository to give people insight into how to report security issues for Koha. https://docs.github.com/en/code-security/getting-started/adding-a-security-p... -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40527 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40527 --- Comment #1 from David Cook <dcook@prosentient.com.au> --- Created attachment 184701 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=184701&action=edit Bug 40527: Initial draft of SECURITY.md This patch includes an initial draft of a proposed SECURITY.md guideline for reporting security bugs to Koha. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40527 Lin Wei <lin-wei.li@inLibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40527 Lin Wei <lin-wei.li@inLibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #184701|0 |1 is obsolete| | --- Comment #2 from Lin Wei <lin-wei.li@inLibro.com> --- Created attachment 186183 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=186183&action=edit Bug 40527: Initial draft of SECURITY.md This patch includes an initial draft of a proposed SECURITY.md guideline for reporting security bugs to Koha. Signed-off-by: Ludovic Julien <ludovic.julien@inLibro.com> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40527 Ludovic <ludovic.julien@inLibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ludovic.julien@inLibro.com --- Comment #3 from Ludovic <ludovic.julien@inLibro.com> --- This is a great addition! Having a clear and well-documented SECURITY.md makes it easier for community members to report vulnerabilities responsibly and helps ensure timely responses. I especially appreciate the clear step-by-step instructions and the reminder about keeping private information out of summaries. One possible improvement could be to explicitly list the expected response time range (even approximate), so reporters know what to expect. Overall, this is a very useful and important patch for improving Koha's security posture. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40527 --- Comment #4 from David Cook <dcook@prosentient.com.au> --- (In reply to Ludovic from comment #3)
This is a great addition!
Thanks, Ludovic!
One possible improvement could be to explicitly list the expected response time range (even approximate), so reporters know what to expect.
It's a good suggestion. I did think about that, but I couldn't come up with a good answer. The best I could do was "as quickly as possible". Personally, I try to respond as soon as I see one has been raised, which is usually within 24-72 hours I think, but sometimes I'm not available (whether it's holiday, sickness, or other work commitments) or maybe I don't see it due to an email glitch. Maybe that's something we can discuss further in the community. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40527 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |dcook@prosentient.com.au |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40527 Lisette Scheer <lisette@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40527 Lisette Scheer <lisette@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #186183|0 |1 is obsolete| | --- Comment #5 from Lisette Scheer <lisette@bywatersolutions.com> --- Created attachment 186993 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=186993&action=edit Bug 40527: Initial draft of SECURITY.md This patch includes an initial draft of a proposed SECURITY.md guideline for reporting security bugs to Koha. Signed-off-by: Ludovic Julien <ludovic.julien@inLibro.com> Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40527 Lisette Scheer <lisette@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lisette@bywatersolutions.co | |m --- Comment #6 from Lisette Scheer <lisette@bywatersolutions.com> --- I think that would be a good community discussion. Maybe the next General meeting? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40527 Lisette Scheer <lisette@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |release-notes-needed -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40527 --- Comment #7 from David Cook <dcook@prosentient.com.au> --- (In reply to Lisette Scheer from comment #6)
I think that would be a good community discussion. Maybe the next General meeting?
I can never make the meetings but wouldn't hurt -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40527 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lucas@bywatersolutions.com QA Contact|testopia@bugs.koha-communit |lisette@bywatersolutions.co |y.org |m -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40527 Lisette Scheer <lisette@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the| |This enhancement adds a release notes| |markdown file to the Koha | |project repository to make | |it clear how to report | |security issues. Keywords|release-notes-needed | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40527 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to main Version(s)| |25.11.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40527 --- Comment #8 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Nice work everyone! Pushed to main for 25.11 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40527 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |additional_work_needed --- Comment #9 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- kohadev-koha@kohadevbox:koha(main)$ prove -v /kohadevbox/koha/t/Makefile.t /kohadevbox/koha/t/Makefile.t .. 1..3 ok 1 - We should test something not ok 2 - All directories should be mapped: SECURITY.md # Failed test 'All directories should be mapped: SECURITY.md' # at /kohadevbox/koha/t/Makefile.t line 53. # got: '1' # expected: '0' ok 3 - no warnings # Looks like you failed 1 test of 3. Dubious, test returned 1 (wstat 256, 0x100) Failed 1/3 subtests -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40527 --- Comment #10 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- Created attachment 187710 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=187710&action=edit Bug 40527: Add SECURITY.md to ignored list in MakeFile.t -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40527 Lucas Gass (lukeg) <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|additional_work_needed | --- Comment #11 from Lucas Gass (lukeg) <lucas@bywatersolutions.com> --- follow-up pushed to main -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40527 Laura Escamilla <Laura.escamilla@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to main |Needs documenting Version(s)|25.11.00 |25.11.00, 25.05.00 released in| | CC| |Laura.escamilla@bywatersolu | |tions.com --- Comment #12 from Laura Escamilla <Laura.escamilla@bywatersolutions.com> --- This change has been backported to the 25.05.x branch. Thank you! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40527 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|25.11.00, 25.05.00 |25.11.00,25.05.07 released in| | CC| |fridolin.somers@biblibre.co | |m -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40527 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|25.11.00,25.05.07 |25.11.00,25.05.07,24.11.12 released in| | --- Comment #13 from Fridolin Somers <fridolin.somers@biblibre.com> --- I think it is a good idea to have it in 24.11 LTS Pushed to 24.11.x for 24.11.12 -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org