Versions Compared

Old Version 20

changes.mady.by.user Unknown User (mjc)

Saved on

compared with

New Version 21

changes.mady.by.user Unknown User (mjc)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: discussion of EOL dependencies

...

  • Have a better EOL policy with defined communication routes, policy for CVE in EOL releases.
  • Have a policy around projects that depend on other EOL projects (ASF and non-ASF)
  • More 2FA requirements
  • Consider if projects that are not releasing regularly are really healthy.  Could they realistically respond to a security vulnerability in a reasonable time frame?
  • Make sure we upgrade our CNA CVE process to JSON 5.0 to make use of the additional record data
  • Would OpenSSF sigstore be a future replacement for current signing policies
  • Should have more complete policy around production of "builds" https://www.apache.org/legal/release-policy.html#compiled-packages
  • Look at OpenSSF AllStar
  • Sometimes communication with vulnerability reporters breaks down, is it time to have a more structured tool for handling reports which forces the process? or is it more people engagement? or can we just require checkboxes before allocating CVE names in our existing tool?

...