You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@oozie.apache.org by Apache Security Team <se...@apache.org> on 2025/01/06 15:50:18 UTC
Re: Help needed: Oozie security triage and followup
Dear Oozie users and developers,
As this call for volunteers yielded no responses, and a security roll call
to the PMC yielded no responses either, we expect to initiate the Attic
process next week.
Kind regards,
Arnout Engelen
ASF Security
On Wed, Oct 30, 2024 at 2:18 PM Apache Security Team <se...@apache.org>
wrote:
> Dear Oozie users and developers,
>
> As you know, the Apache Software Foundation takes our users' security
> seriously, and defines sensible release and security processes to make sure
> potential security issues are dealt with responsibly. These indirectly also
> protect our committers, shielding individuals from personal liability. Some
> of this process is necessarily done in private; as we practice responsible
> disclosure.
>
> We are seeing potential security issues are reported privately to the
> Oozie PMC, but the PMC currently does not appear to have the bandwidth to
> triage (and, if necessary, fix and disclose) them.
>
> On behalf of the PMC: would anyone be interested in helping out here? If
> so, please contact private@oozie.apache.org with security@apache.org in
> Cc.
>
> If you’re using this project in a professional capacity, now would be a
> good time to campaign to allocate time to participate to keep the project
> healthy. This is the first step of our more formal security escalation
> process[0]. If the Oozie project cannot return to a healthy cadence of
> dealing with security issues, the only responsible decision for the PMC
> (which is collectively responsible for the oversight of the project) would
> be to initiate the move to the Attic [1]. Of course we hope this can be
> prevented.
>
> As this message is going to the public mailinglist, please do not share
> sensitive information in this thread.
>
>
> Kind regards,
>
> The ASF Security Team
> [0]
> https://cwiki.apache.org/confluence/display/SECURITY/Project+Security+Response+Formal+Escalation
> [1] https://attic.apache.org/
>
Re: Help needed: Oozie security triage and followup
Posted by Dénes Bodó <di...@apache.org>.
Hey Arnout,
If possible, please allow me/us one last push into the project. If we can solve the build issues then maybe we will able to be a little bit more efficient.
Sorry, answering from lists.apache.org I cannot add any mail address into CC but I will let you know about my message directly.
Regards,
Denes
On 2025/01/06 15:50:18 Apache Security Team wrote:
> Dear Oozie users and developers,
>
> As this call for volunteers yielded no responses, and a security roll call
> to the PMC yielded no responses either, we expect to initiate the Attic
> process next week.
>
>
> Kind regards,
>
> Arnout Engelen
> ASF Security
>
> On Wed, Oct 30, 2024 at 2:18 PM Apache Security Team <se...@apache.org>
> wrote:
>
> > Dear Oozie users and developers,
> >
> > As you know, the Apache Software Foundation takes our users' security
> > seriously, and defines sensible release and security processes to make sure
> > potential security issues are dealt with responsibly. These indirectly also
> > protect our committers, shielding individuals from personal liability. Some
> > of this process is necessarily done in private; as we practice responsible
> > disclosure.
> >
> > We are seeing potential security issues are reported privately to the
> > Oozie PMC, but the PMC currently does not appear to have the bandwidth to
> > triage (and, if necessary, fix and disclose) them.
> >
> > On behalf of the PMC: would anyone be interested in helping out here? If
> > so, please contact private@oozie.apache.org with security@apache.org in
> > Cc.
> >
> > If you’re using this project in a professional capacity, now would be a
> > good time to campaign to allocate time to participate to keep the project
> > healthy. This is the first step of our more formal security escalation
> > process[0]. If the Oozie project cannot return to a healthy cadence of
> > dealing with security issues, the only responsible decision for the PMC
> > (which is collectively responsible for the oversight of the project) would
> > be to initiate the move to the Attic [1]. Of course we hope this can be
> > prevented.
> >
> > As this message is going to the public mailinglist, please do not share
> > sensitive information in this thread.
> >
> >
> > Kind regards,
> >
> > The ASF Security Team
> > [0]
> > https://cwiki.apache.org/confluence/display/SECURITY/Project+Security+Response+Formal+Escalation
> > [1] https://attic.apache.org/
> >
>
Re: Help needed: Oozie security triage and followup
Posted by János Makai <jm...@apache.org>.
Dear ASF Security Team,
Apologies for the delayed response.
I am open to being available to support the Apache Oozie project as circumstances may require.
Kind Regards,
Janos
On 2025/01/06 15:50:18 Apache Security Team wrote:
> Dear Oozie users and developers,
>
> As this call for volunteers yielded no responses, and a security roll call
> to the PMC yielded no responses either, we expect to initiate the Attic
> process next week.
>
>
> Kind regards,
>
> Arnout Engelen
> ASF Security
>
> On Wed, Oct 30, 2024 at 2:18 PM Apache Security Team <se...@apache.org>
> wrote:
>
> > Dear Oozie users and developers,
> >
> > As you know, the Apache Software Foundation takes our users' security
> > seriously, and defines sensible release and security processes to make sure
> > potential security issues are dealt with responsibly. These indirectly also
> > protect our committers, shielding individuals from personal liability. Some
> > of this process is necessarily done in private; as we practice responsible
> > disclosure.
> >
> > We are seeing potential security issues are reported privately to the
> > Oozie PMC, but the PMC currently does not appear to have the bandwidth to
> > triage (and, if necessary, fix and disclose) them.
> >
> > On behalf of the PMC: would anyone be interested in helping out here? If
> > so, please contact private@oozie.apache.org with security@apache.org in
> > Cc.
> >
> > If you’re using this project in a professional capacity, now would be a
> > good time to campaign to allocate time to participate to keep the project
> > healthy. This is the first step of our more formal security escalation
> > process[0]. If the Oozie project cannot return to a healthy cadence of
> > dealing with security issues, the only responsible decision for the PMC
> > (which is collectively responsible for the oversight of the project) would
> > be to initiate the move to the Attic [1]. Of course we hope this can be
> > prevented.
> >
> > As this message is going to the public mailinglist, please do not share
> > sensitive information in this thread.
> >
> >
> > Kind regards,
> >
> > The ASF Security Team
> > [0]
> > https://cwiki.apache.org/confluence/display/SECURITY/Project+Security+Response+Formal+Escalation
> > [1] https://attic.apache.org/
> >
>
Re: Help needed: Oozie security triage and followup
Posted by Dénes Bodó <di...@apache.org>.
Hey Arnout,
as I see there are some happenings regarding the security fixes: OOZIE-3725.
Oozie developers! Is there anybody who could spend any time with Apache Oozie?
Thanks,
Denes
On 2025/01/06 15:50:18 Apache Security Team wrote:
> Dear Oozie users and developers,
>
> As this call for volunteers yielded no responses, and a security roll call
> to the PMC yielded no responses either, we expect to initiate the Attic
> process next week.
>
>
> Kind regards,
>
> Arnout Engelen
> ASF Security
>
> On Wed, Oct 30, 2024 at 2:18 PM Apache Security Team <se...@apache.org>
> wrote:
>
> > Dear Oozie users and developers,
> >
> > As you know, the Apache Software Foundation takes our users' security
> > seriously, and defines sensible release and security processes to make sure
> > potential security issues are dealt with responsibly. These indirectly also
> > protect our committers, shielding individuals from personal liability. Some
> > of this process is necessarily done in private; as we practice responsible
> > disclosure.
> >
> > We are seeing potential security issues are reported privately to the
> > Oozie PMC, but the PMC currently does not appear to have the bandwidth to
> > triage (and, if necessary, fix and disclose) them.
> >
> > On behalf of the PMC: would anyone be interested in helping out here? If
> > so, please contact private@oozie.apache.org with security@apache.org in
> > Cc.
> >
> > If you’re using this project in a professional capacity, now would be a
> > good time to campaign to allocate time to participate to keep the project
> > healthy. This is the first step of our more formal security escalation
> > process[0]. If the Oozie project cannot return to a healthy cadence of
> > dealing with security issues, the only responsible decision for the PMC
> > (which is collectively responsible for the oversight of the project) would
> > be to initiate the move to the Attic [1]. Of course we hope this can be
> > prevented.
> >
> > As this message is going to the public mailinglist, please do not share
> > sensitive information in this thread.
> >
> >
> > Kind regards,
> >
> > The ASF Security Team
> > [0]
> > https://cwiki.apache.org/confluence/display/SECURITY/Project+Security+Response+Formal+Escalation
> > [1] https://attic.apache.org/
> >
>