DUE TO SPAM, SIGN-UP IS DISABLED. Goto Selfserve wiki signup and request an account.
...
- Have a better EOL policy with defined communication routes, policy for CVE in EOL releases. See also this thread about Attic
- Have a policy around projects that depend on other EOL projects (ASF and non-ASF)
- More 2FA requirements
- Consider if projects that are not releasing regularly are really healthy. Could they realistically respond to a security vulnerability in a reasonable time frame?
- Make sure we upgrade our CNA CVE process to JSON 5.0 to make use of the additional record data
- We probably ought to fix every CVE entry so the version_data works well for 5.0, see for example https://vulnogram.github.io/seaview/?CVE-2021-44549
- Would OpenSSF sigstore be a future replacement for current signing policies. See also mail from GOSST
- Should have more complete policy around production of "builds" https://www.apache.org/legal/release-policy.html#compiled-packages
- Look at OpenSSF AllStar
- Give more guidance on how to deal with 'low severity' issues to avoid them 'hanging around' and distracting from more urgent things
WH Theme: Preventing Defects
- Make sure our projects are keeping track of their dependencies, especially things that are EOL, especially things that are other Apache projects and EOL (example log4j v1)
- Track the dependencies across our projects so we can see the combined-graph for the latest version of each ASF project. Work centrally to encourage that dependencies are not insecure, or excessively dated.
- Facilitate direct funding efforts such as TideLift which provide direct financial support for developers to focus on matters such as security
- How does OpenSSF Alpha and/or Omega fit with ASF
- Look at the sponsored SOS rewards program
- Think about which ASF projects would benefit from being covered by IBB (they reached out to us to expand our current set)
- Looks at OpenSSF OSS Fuzz (high false positive rate - would benefit from manual triage by OSS Fuzz team before notifications are sent to maintainers). See also mail from GOSST.
WH Theme: Identify Critical projects / Help users pick secure projects
...
- See SBOM page
- Look at providing vulnerability data in a format that can be combined with SBOM such as VEX (CSAF) and/or OSV https://osv.dev/
- Look at EOL notifications CSAF as an example https://access.redhat.com/security/data/csaf/beta/2019/rhsa-2019_1862.json
- We have no way to know who is using our projects, nor do we want to capture that data (so is the current vulnerability notification system sufficient?)
...