1berry/nodejs
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nodejs/doc/guides/security-release-process.md

94 lines
3.7 KiB
Markdown
Raw Normal View History

doc: security maintenance processes The TSC has responsibility for Node.js security, so avoid fragmentation of the Node.js maintenance process documentation by adding it to the other guides. PR-URL: https://github.com/nodejs/node/pull/29685 Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
2019-09-23 16:28:23 -07:00
# Security Release Process
doc: de-duplicate security release processes The security release process is spread across multiple files. Merge these two files to remove duplication and inconsistency. Also, make the format more useful for inserting into the description of the Next Security Release issue description. This seems an obvious candidate for a github issue template, but if it was, the content would not be reviewable by anyone outside of those on the security teams, and the process should be public for purposes of transparency and review. PR-URL: https://github.com/nodejs/node/pull/30996 Reviewed-By: Rich Trott <rtrott@gmail.com>
2019-12-16 16:38:27 -05:00
The security release process covers the steps required to plan/implement a
security release. This document is copied into the description of the Next
doc: fix typo in security-release-process.md PR-URL: https://github.com/nodejs/node/pull/32926 Reviewed-By: David Carlier <devnexen@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Zeyu Yang <himself65@outlook.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
2020-04-19 16:40:18 +08:00
Security Release, and used to track progress on the release. It contains ***TEXT
doc: update security release process PR-URL: https://github.com/nodejs/node/pull/31679 Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Richard Lau <riclau@uk.ibm.com>
2020-02-07 11:10:27 -08:00
LIKE THIS*** which will be replaced during the release process with the
information described.
doc: security maintenance processes The TSC has responsibility for Node.js security, so avoid fragmentation of the Node.js maintenance process documentation by adding it to the other guides. PR-URL: https://github.com/nodejs/node/pull/29685 Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
2019-09-23 16:28:23 -07:00
## Planning
doc: update security release process PR-URL: https://github.com/nodejs/node/pull/31679 Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Richard Lau <riclau@uk.ibm.com>
2020-02-07 11:10:27 -08:00
* [ ] Open an [issue](https://github.com/nodejs-private/node-private) titled
`Next Security Release`, and put this checklist in the description.
doc: security maintenance processes The TSC has responsibility for Node.js security, so avoid fragmentation of the Node.js maintenance process documentation by adding it to the other guides. PR-URL: https://github.com/nodejs/node/pull/29685 Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
2019-09-23 16:28:23 -07:00
doc: de-duplicate security release processes The security release process is spread across multiple files. Merge these two files to remove duplication and inconsistency. Also, make the format more useful for inserting into the description of the Next Security Release issue description. This seems an obvious candidate for a github issue template, but if it was, the content would not be reviewable by anyone outside of those on the security teams, and the process should be public for purposes of transparency and review. PR-URL: https://github.com/nodejs/node/pull/30996 Reviewed-By: Rich Trott <rtrott@gmail.com>
2019-12-16 16:38:27 -05:00
* [ ] Get agreement on the list of vulnerabilities to be addressed:
doc: update security release process PR-URL: https://github.com/nodejs/node/pull/31679 Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Richard Lau <riclau@uk.ibm.com>
2020-02-07 11:10:27 -08:00
* ***H1 REPORT LINK***: ***DESCRIPTION*** (***CVE or H1 CVE request link***)
* v10.x, v12.x: ***LINK to PR URL***
* ...
* [ ] PR release announcements in [private](https://github.com/nodejs-private/nodejs.org-private):
* (Use previous PRs as templates, don't forget to update the site banner, and
the date in the slug so that it will move to the top of the blog list.)
* [ ] pre-release: ***LINK TO PR***
* [ ] post-release: ***LINK TO PR***
doc: security maintenance processes The TSC has responsibility for Node.js security, so avoid fragmentation of the Node.js maintenance process documentation by adding it to the other guides. PR-URL: https://github.com/nodejs/node/pull/29685 Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
2019-09-23 16:28:23 -07:00
doc: de-duplicate security release processes The security release process is spread across multiple files. Merge these two files to remove duplication and inconsistency. Also, make the format more useful for inserting into the description of the Next Security Release issue description. This seems an obvious candidate for a github issue template, but if it was, the content would not be reviewable by anyone outside of those on the security teams, and the process should be public for purposes of transparency and review. PR-URL: https://github.com/nodejs/node/pull/30996 Reviewed-By: Rich Trott <rtrott@gmail.com>
2019-12-16 16:38:27 -05:00
* [ ] Get agreement on the planned date for the release: ***RELEASE DATE***
doc: security maintenance processes The TSC has responsibility for Node.js security, so avoid fragmentation of the Node.js maintenance process documentation by adding it to the other guides. PR-URL: https://github.com/nodejs/node/pull/29685 Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
2019-09-23 16:28:23 -07:00
doc: update security release process PR-URL: https://github.com/nodejs/node/pull/31679 Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Richard Lau <riclau@uk.ibm.com>
2020-02-07 11:10:27 -08:00
* [ ] Get release team volunteers for all affected lines:
* v12.x: ***NAME of RELEASER(S)***
* ... other lines, if multiple releasers
## Announcement (one week in advance of the planned release)
doc: security maintenance processes The TSC has responsibility for Node.js security, so avoid fragmentation of the Node.js maintenance process documentation by adding it to the other guides. PR-URL: https://github.com/nodejs/node/pull/29685 Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
2019-09-23 16:28:23 -07:00
doc: update security release process PR-URL: https://github.com/nodejs/node/pull/31679 Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Richard Lau <riclau@uk.ibm.com>
2020-02-07 11:10:27 -08:00
* [ ] Check that all vulnerabilities are ready for release integration:
* PRs against all affected release lines or cherry-pick clean
* Approved
* Pass `make test`
* Have CVEs
* Described in the pre/post announcements
doc: security maintenance processes The TSC has responsibility for Node.js security, so avoid fragmentation of the Node.js maintenance process documentation by adding it to the other guides. PR-URL: https://github.com/nodejs/node/pull/29685 Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
2019-09-23 16:28:23 -07:00
doc: update security release process PR-URL: https://github.com/nodejs/node/pull/31679 Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Richard Lau <riclau@uk.ibm.com>
2020-02-07 11:10:27 -08:00
* [ ] Pre-release announcement [email][]: ***LINK TO EMAIL***
(Get access from existing manager: Ben Noordhuis, Rod Vagg, Michael Dawson)
doc: security maintenance processes The TSC has responsibility for Node.js security, so avoid fragmentation of the Node.js maintenance process documentation by adding it to the other guides. PR-URL: https://github.com/nodejs/node/pull/29685 Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
2019-09-23 16:28:23 -07:00
doc: update security release process PR-URL: https://github.com/nodejs/node/pull/31679 Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Richard Lau <riclau@uk.ibm.com>
2020-02-07 11:10:27 -08:00
* [ ] Pre-release announcement to nodejs.org blog: ***LINK TO BLOG***
(Re-PR the pre-approved branch from nodejs-private/nodejs.org-private to
nodejs/nodejs.org)
doc: security maintenance processes The TSC has responsibility for Node.js security, so avoid fragmentation of the Node.js maintenance process documentation by adding it to the other guides. PR-URL: https://github.com/nodejs/node/pull/29685 Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
2019-09-23 16:28:23 -07:00
doc: update security release process PR-URL: https://github.com/nodejs/node/pull/31679 Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Richard Lau <riclau@uk.ibm.com>
2020-02-07 11:10:27 -08:00
* [ ] Request releaser(s) to start integrating the PRs to be released.
* [ ] Notify [docker-node][] of upcoming security release date: ***LINK***
* [ ] Notify build-wg of upcoming security release date by opening an issue
in [nodejs/build][] to request WG members are available to fix any CI issues.
doc: security maintenance processes The TSC has responsibility for Node.js security, so avoid fragmentation of the Node.js maintenance process documentation by adding it to the other guides. PR-URL: https://github.com/nodejs/node/pull/29685 Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
2019-09-23 16:28:23 -07:00
doc: de-duplicate security release processes The security release process is spread across multiple files. Merge these two files to remove duplication and inconsistency. Also, make the format more useful for inserting into the description of the Next Security Release issue description. This seems an obvious candidate for a github issue template, but if it was, the content would not be reviewable by anyone outside of those on the security teams, and the process should be public for purposes of transparency and review. PR-URL: https://github.com/nodejs/node/pull/30996 Reviewed-By: Rich Trott <rtrott@gmail.com>
2019-12-16 16:38:27 -05:00
## Release day
doc: security maintenance processes The TSC has responsibility for Node.js security, so avoid fragmentation of the Node.js maintenance process documentation by adding it to the other guides. PR-URL: https://github.com/nodejs/node/pull/29685 Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
2019-09-23 16:28:23 -07:00
doc: update security release process PR-URL: https://github.com/nodejs/node/pull/31679 Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Richard Lau <riclau@uk.ibm.com>
2020-02-07 11:10:27 -08:00
* [ ] [Lock CI](https://github.com/nodejs/build/blob/master/doc/jenkins-guide.md#before-the-release)
doc: de-duplicate security release processes The security release process is spread across multiple files. Merge these two files to remove duplication and inconsistency. Also, make the format more useful for inserting into the description of the Next Security Release issue description. This seems an obvious candidate for a github issue template, but if it was, the content would not be reviewable by anyone outside of those on the security teams, and the process should be public for purposes of transparency and review. PR-URL: https://github.com/nodejs/node/pull/30996 Reviewed-By: Rich Trott <rtrott@gmail.com>
2019-12-16 16:38:27 -05:00
* [ ] The releaser(s) run the release process to completion.
doc: security maintenance processes The TSC has responsibility for Node.js security, so avoid fragmentation of the Node.js maintenance process documentation by adding it to the other guides. PR-URL: https://github.com/nodejs/node/pull/29685 Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
2019-09-23 16:28:23 -07:00
doc: update security release process PR-URL: https://github.com/nodejs/node/pull/31679 Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Richard Lau <riclau@uk.ibm.com>
2020-02-07 11:10:27 -08:00
* [ ] [Unlock CI](https://github.com/nodejs/build/blob/master/doc/jenkins-guide.md#after-the-release)
* [ ] Post-release announcement in reply [email][]: ***LINK TO EMAIL***
* [ ] Post-release announcement to Nodejs.org blog: ***LINK TO BLOG POST***
* (Re-PR the pre-approved branch from nodejs-private/nodejs.org-private to
nodejs/nodejs.org)
* [ ] Email `"Rachel Romoff" <rromoff@linuxfoundation.org>` to tweet an
announcement, or if you are on twitter you can just direct message the
`@nodejs` handle.
* [ ] Comment in [docker-node][] issue that release is ready for integration.
The docker-node team will build and release docker image updates.
* [ ] For every H1 report resolved:
* Close as Resolved
* Request Disclosure
* Request publication of [H1 CVE requests][]
* (Check that the "Version Fixed" field in the CVE is correct, and provide
links to the release blogs in the "Public Reference" section)
doc: security maintenance processes The TSC has responsibility for Node.js security, so avoid fragmentation of the Node.js maintenance process documentation by adding it to the other guides. PR-URL: https://github.com/nodejs/node/pull/29685 Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
2019-09-23 16:28:23 -07:00
* [ ] PR machine-readable JSON descriptions of the vulnerabilities to the
[core](https://github.com/nodejs/security-wg/tree/master/vuln/core)
doc: de-duplicate security release processes The security release process is spread across multiple files. Merge these two files to remove duplication and inconsistency. Also, make the format more useful for inserting into the description of the Next Security Release issue description. This seems an obvious candidate for a github issue template, but if it was, the content would not be reviewable by anyone outside of those on the security teams, and the process should be public for purposes of transparency and review. PR-URL: https://github.com/nodejs/node/pull/30996 Reviewed-By: Rich Trott <rtrott@gmail.com>
2019-12-16 16:38:27 -05:00
vulnerability DB. ***LINK TO PR***
doc: security maintenance processes The TSC has responsibility for Node.js security, so avoid fragmentation of the Node.js maintenance process documentation by adding it to the other guides. PR-URL: https://github.com/nodejs/node/pull/29685 Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
2019-09-23 16:28:23 -07:00
doc: update security release process PR-URL: https://github.com/nodejs/node/pull/31679 Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Richard Lau <riclau@uk.ibm.com>
2020-02-07 11:10:27 -08:00
* [ ] Close this issue
doc: security maintenance processes The TSC has responsibility for Node.js security, so avoid fragmentation of the Node.js maintenance process documentation by adding it to the other guides. PR-URL: https://github.com/nodejs/node/pull/29685 Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
2019-09-23 16:28:23 -07:00
* [ ] Make sure the PRs for the vulnerabilities are closed.
doc: update security release process PR-URL: https://github.com/nodejs/node/pull/31679 Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Richard Lau <riclau@uk.ibm.com>
2020-02-07 11:10:27 -08:00
[H1 CVE requests]: https://hackerone.com/nodejs/cve_requests
[docker-node]: https://github.com/nodejs/docker-node/issues)
[nodejs/build]: https://github.com/nodejs/build/issues)
[email]: https://groups.google.com/forum/#!forum/nodejs-sec
Reference in New Issue Copy Permalink