You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "potiuk (via GitHub)" <gi...@apache.org> on 2023/07/08 08:05:22 UTC
[GitHub] [airflow] potiuk opened a new pull request, #32439: Add few clarifications to our security policy
potiuk opened a new pull request, #32439:
URL: https://github.com/apache/airflow/pull/32439
* Brought clearer instructions on how to report issues with one issue per email in plain text from the https://www.apache.org/security/
* Provided specific exclusions for security scan results for image, adding instructions on how to build your own image and how Airflow image is produced
* Brought information from https://www.apache.org/security/ that **only** undisclosed security issues can be handled via security@a.a.o not general dicussions on security and bug reports
<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
-->
<!--
Thank you for contributing! Please make sure that your code changes
are covered with tests. And in case of new features or big changes
remember to adjust the documentation.
Feel free to ping committers for the review!
In case of an existing issue, reference it using one of the following:
closes: #ISSUE
related: #ISSUE
How to write a good git commit message:
http://chris.beams.io/posts/git-commit/
-->
---
**^ Add meaningful description above**
Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/CONTRIBUTING.rst#pull-request-guidelines)** for more information.
In case of fundamental code changes, an Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals)) is needed.
In case of a new dependency, check compliance with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html#category-x).
In case of backwards incompatible changes please leave a note in a newsfragment file, named `{pr_number}.significant.rst` or `{issue_number}.significant.rst`, in [newsfragments](https://github.com/apache/airflow/tree/main/newsfragments).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] pankajkoti commented on a diff in pull request #32439: Add few clarifications to our security policy
Posted by "pankajkoti (via GitHub)" <gi...@apache.org>.
pankajkoti commented on code in PR #32439:
URL: https://github.com/apache/airflow/pull/32439#discussion_r1257172401
##########
.github/SECURITY.md:
##########
@@ -31,14 +31,25 @@ Airflow specifically offers security features and is responsive to issues
around its features. If you have any concern around Airflow Security or believe
you have uncovered a vulnerability, we suggest that you get in touch via the
e-mail address [security@airflow.apache.org](mailto:security@airflow.apache.org).
-In the message, try to provide a description of the issue and ideally a way of
-reproducing it. The security team will get back to you after assessing the report.
-Note that this security address should be used only for undisclosed
-vulnerabilities. Dealing with fixed issues or general questions on how to use
-the security features should be handled regularly via the user and the dev
-lists. Please report any security problems to the project security address
-before disclosing it publicly.
+**Only** use the security contacts to report undisclosed security vulnerabilities in Apache
+Airflow and manage the process of fixing such vulnerabilities. We cannot accept regular
+bug reports or other security-related queries at these addresses. We will ignore mail
+sent to this address that does not relate to an undisclosed security problem
+in the Apache Airflow project. Please follow regular communication channels described in
+the [Airflow Community](https://airflow.apache.org/community/index.html) page for
+inquiries, questions and other discussions related to the process or issues.
+
+Specifically, we will ignore results of security scans that contain list of
+dependencies of Airflow with dependencies in Airflow Docker reference image - there
+is a page that describes how the
+[Airflow reference Image is fixed at release time](https://airflow.apache.org/docs/docker-stack/index.html#fixing-images-at-release-time)
+and providing helpful instructions explaining general instruction on how you can build your
+own image and manage dependencies of Airflow in your own image.
+
+**Please send one plain-text email for each vulnerability you are reporting including explanation
+how it affects airflow security. We may ask you to resubmit your report if you send it as an image,
+~~movie, HTML, or PDF attachment when you could as easily describe it with plain text.**~~
Review Comment:
```suggestion
movie, HTML, or PDF attachment when you could as easily describe it with plain text.**
```
Suggesting to remove the ~~, but unsure if it was put their intentionally and what it means for Markdown.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk merged pull request #32439: Add few clarifications to our security policy
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk merged PR #32439:
URL: https://github.com/apache/airflow/pull/32439
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] pankajkoti commented on a diff in pull request #32439: Add few clarifications to our security policy
Posted by "pankajkoti (via GitHub)" <gi...@apache.org>.
pankajkoti commented on code in PR #32439:
URL: https://github.com/apache/airflow/pull/32439#discussion_r1257170537
##########
.github/SECURITY.md:
##########
@@ -49,7 +60,11 @@ in other products/circumstances. Therefore, some potential security vulnerabilit
apply to Airflow, or have a different severity than some generic scoring systems (for example `CVSS`)
calculation suggests.
-The [ASF Security team's page](https://www.apache.org/security/) describes
+The security team (see below "Handling security issues in Airflow") will get back to
Review Comment:
```suggestion
The security team (see below [Handling security issues in Airflow](https://github.com/apache/airflow/security#handling-security-issues-in-airflow)) will get back to
```
##########
.github/SECURITY.md:
##########
@@ -49,7 +60,11 @@ in other products/circumstances. Therefore, some potential security vulnerabilit
apply to Airflow, or have a different severity than some generic scoring systems (for example `CVSS`)
calculation suggests.
-The [ASF Security team's page](https://www.apache.org/security/) describes
+The security team (see below "Handling security issues in Airflow") will get back to
Review Comment:
perhaps this may work too? (if we would like to consider :) )
##########
.github/SECURITY.md:
##########
@@ -31,14 +31,25 @@ Airflow specifically offers security features and is responsive to issues
around its features. If you have any concern around Airflow Security or believe
you have uncovered a vulnerability, we suggest that you get in touch via the
e-mail address [security@airflow.apache.org](mailto:security@airflow.apache.org).
-In the message, try to provide a description of the issue and ideally a way of
-reproducing it. The security team will get back to you after assessing the report.
-Note that this security address should be used only for undisclosed
-vulnerabilities. Dealing with fixed issues or general questions on how to use
-the security features should be handled regularly via the user and the dev
-lists. Please report any security problems to the project security address
-before disclosing it publicly.
+**Only** use the security contacts to report undisclosed security vulnerabilities in Apache
+Airflow and manage the process of fixing such vulnerabilities. We cannot accept regular
+bug reports or other security-related queries at these addresses. We will ignore mail
+sent to this address that does not relate to an undisclosed security problem
+in the Apache Airflow project. Please follow regular communication channels described in
+the [Airflow Community](https://airflow.apache.org/community/index.html) page for
+inquiries, questions and other discussions related to the process or issues.
+
+Specifically, we will ignore results of security scans that contain list of
+dependencies of Airflow with dependencies in Airflow Docker reference image - there
+is a page that describes how the
+[Airflow reference Image is fixed at release time](https://airflow.apache.org/docs/docker-stack/index.html#fixing-images-at-release-time)
+and providing helpful instructions explaining general instruction on how you can build your
+own image and manage dependencies of Airflow in your own image.
+
+**Please send one plain-text email for each vulnerability you are reporting including explanation
+how it affects airflow security. We may ask you to resubmit your report if you send it as an image,
+~~movie, HTML, or PDF attachment when you could as easily describe it with plain text.**~~
Review Comment:
```suggestion
movie, HTML, or PDF attachment when you could as easily describe it with plain text.**
```
Suggesting to remove the ~~, but unsure if it was put their intentionally and what it means for Markup.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] phanikumv commented on a diff in pull request #32439: Add few clarifications to our security policy
Posted by "phanikumv (via GitHub)" <gi...@apache.org>.
phanikumv commented on code in PR #32439:
URL: https://github.com/apache/airflow/pull/32439#discussion_r1257601628
##########
.github/SECURITY.md:
##########
@@ -31,14 +31,25 @@ Airflow specifically offers security features and is responsive to issues
around its features. If you have any concern around Airflow Security or believe
you have uncovered a vulnerability, we suggest that you get in touch via the
e-mail address [security@airflow.apache.org](mailto:security@airflow.apache.org).
-In the message, try to provide a description of the issue and ideally a way of
-reproducing it. The security team will get back to you after assessing the report.
-Note that this security address should be used only for undisclosed
-vulnerabilities. Dealing with fixed issues or general questions on how to use
-the security features should be handled regularly via the user and the dev
-lists. Please report any security problems to the project security address
-before disclosing it publicly.
+**Only** use the security contacts to report undisclosed security vulnerabilities in Apache
+Airflow and manage the process of fixing such vulnerabilities. We cannot accept regular
+bug reports or other security-related queries at these addresses. We will ignore mail
+sent to this address that does not relate to an undisclosed security problem
+in the Apache Airflow project. Please follow regular communication channels described in
+the [Airflow Community](https://airflow.apache.org/community/index.html) page for
+inquiries, questions and other discussions related to the process or issues.
+
+Specifically, we will ignore results of security scans that contain list of
+dependencies of Airflow with dependencies in Airflow Docker reference image - there
+is a page that describes how the
+[Airflow reference Image is fixed at release time](https://airflow.apache.org/docs/docker-stack/index.html#fixing-images-at-release-time)
+and providing helpful instructions explaining general instruction on how you can build your
Review Comment:
```suggestion
and providing helpful instructions explaining how you can build your
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on a diff in pull request #32439: Add few clarifications to our security policy
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on code in PR #32439:
URL: https://github.com/apache/airflow/pull/32439#discussion_r1258605938
##########
.github/SECURITY.md:
##########
@@ -31,14 +31,25 @@ Airflow specifically offers security features and is responsive to issues
around its features. If you have any concern around Airflow Security or believe
you have uncovered a vulnerability, we suggest that you get in touch via the
e-mail address [security@airflow.apache.org](mailto:security@airflow.apache.org).
-In the message, try to provide a description of the issue and ideally a way of
-reproducing it. The security team will get back to you after assessing the report.
-Note that this security address should be used only for undisclosed
-vulnerabilities. Dealing with fixed issues or general questions on how to use
-the security features should be handled regularly via the user and the dev
-lists. Please report any security problems to the project security address
-before disclosing it publicly.
+**Only** use the security contacts to report undisclosed security vulnerabilities in Apache
+Airflow and manage the process of fixing such vulnerabilities. We cannot accept regular
+bug reports or other security-related queries at these addresses. We will ignore mail
+sent to this address that does not relate to an undisclosed security problem
+in the Apache Airflow project. Please follow regular communication channels described in
+the [Airflow Community](https://airflow.apache.org/community/index.html) page for
+inquiries, questions and other discussions related to the process or issues.
+
+Specifically, we will ignore results of security scans that contain list of
+dependencies of Airflow with dependencies in Airflow Docker reference image - there
+is a page that describes how the
+[Airflow reference Image is fixed at release time](https://airflow.apache.org/docs/docker-stack/index.html#fixing-images-at-release-time)
+and providing helpful instructions explaining how you can build your
+own image and manage dependencies of Airflow in your own image.
+
+**Please send one plain-text email for each vulnerability you are reporting including explanation
Review Comment:
This is straight copy from the ASF rules. While useful to have them (and we do not reject them if accompanied by text description), having videos or images is not something that is easy copy-pasteable and reproducible. For example if you have a POST request with some details, it's rather hard to try to reproduce it based on the video, if you need to copy&paste the post.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on a diff in pull request #32439: Add few clarifications to our security policy
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on code in PR #32439:
URL: https://github.com/apache/airflow/pull/32439#discussion_r1258698913
##########
.github/SECURITY.md:
##########
@@ -31,14 +31,25 @@ Airflow specifically offers security features and is responsive to issues
around its features. If you have any concern around Airflow Security or believe
you have uncovered a vulnerability, we suggest that you get in touch via the
e-mail address [security@airflow.apache.org](mailto:security@airflow.apache.org).
-In the message, try to provide a description of the issue and ideally a way of
-reproducing it. The security team will get back to you after assessing the report.
-Note that this security address should be used only for undisclosed
-vulnerabilities. Dealing with fixed issues or general questions on how to use
-the security features should be handled regularly via the user and the dev
-lists. Please report any security problems to the project security address
-before disclosing it publicly.
+**Only** use the security contacts to report undisclosed security vulnerabilities in Apache
+Airflow and manage the process of fixing such vulnerabilities. We cannot accept regular
+bug reports or other security-related queries at these addresses. We will ignore mail
+sent to this address that does not relate to an undisclosed security problem
+in the Apache Airflow project. Please follow regular communication channels described in
+the [Airflow Community](https://airflow.apache.org/community/index.html) page for
+inquiries, questions and other discussions related to the process or issues.
+
+Specifically, we will ignore results of security scans that contain list of
+dependencies of Airflow with dependencies in Airflow Docker reference image - there
+is a page that describes how the
+[Airflow reference Image is fixed at release time](https://airflow.apache.org/docs/docker-stack/index.html#fixing-images-at-release-time)
+and providing helpful instructions explaining how you can build your
+own image and manage dependencies of Airflow in your own image.
+
+**Please send one plain-text email for each vulnerability you are reporting including explanation
+how it affects airflow security. We may ask you to resubmit your report if you send it as an image,
+movie, HTML, or PDF attachment when you could as easily describe it with plain text.**
Review Comment:
yea. Let's see how many of those "10 security issues from the scanner" we get :). But yes - no problem with not-bolding.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on pull request #32439: Add few clarifications to our security policy
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #32439:
URL: https://github.com/apache/airflow/pull/32439#issuecomment-1628660139
Any more comments?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] o-nikolas commented on a diff in pull request #32439: Add few clarifications to our security policy
Posted by "o-nikolas (via GitHub)" <gi...@apache.org>.
o-nikolas commented on code in PR #32439:
URL: https://github.com/apache/airflow/pull/32439#discussion_r1258597215
##########
.github/SECURITY.md:
##########
@@ -31,14 +31,25 @@ Airflow specifically offers security features and is responsive to issues
around its features. If you have any concern around Airflow Security or believe
you have uncovered a vulnerability, we suggest that you get in touch via the
e-mail address [security@airflow.apache.org](mailto:security@airflow.apache.org).
-In the message, try to provide a description of the issue and ideally a way of
-reproducing it. The security team will get back to you after assessing the report.
-Note that this security address should be used only for undisclosed
-vulnerabilities. Dealing with fixed issues or general questions on how to use
-the security features should be handled regularly via the user and the dev
-lists. Please report any security problems to the project security address
-before disclosing it publicly.
+**Only** use the security contacts to report undisclosed security vulnerabilities in Apache
+Airflow and manage the process of fixing such vulnerabilities. We cannot accept regular
+bug reports or other security-related queries at these addresses. We will ignore mail
+sent to this address that does not relate to an undisclosed security problem
+in the Apache Airflow project. Please follow regular communication channels described in
+the [Airflow Community](https://airflow.apache.org/community/index.html) page for
+inquiries, questions and other discussions related to the process or issues.
+
+Specifically, we will ignore results of security scans that contain list of
+dependencies of Airflow with dependencies in Airflow Docker reference image - there
+is a page that describes how the
+[Airflow reference Image is fixed at release time](https://airflow.apache.org/docs/docker-stack/index.html#fixing-images-at-release-time)
+and providing helpful instructions explaining how you can build your
+own image and manage dependencies of Airflow in your own image.
+
+**Please send one plain-text email for each vulnerability you are reporting including explanation
+how it affects airflow security. We may ask you to resubmit your report if you send it as an image,
Review Comment:
```suggestion
**Please send one plain-text email for each vulnerability you are reporting including an explanation
of how it affects Airflow security. We may ask that you resubmit your report if you send it as an image,
```
##########
.github/SECURITY.md:
##########
@@ -31,14 +31,25 @@ Airflow specifically offers security features and is responsive to issues
around its features. If you have any concern around Airflow Security or believe
you have uncovered a vulnerability, we suggest that you get in touch via the
e-mail address [security@airflow.apache.org](mailto:security@airflow.apache.org).
-In the message, try to provide a description of the issue and ideally a way of
-reproducing it. The security team will get back to you after assessing the report.
-Note that this security address should be used only for undisclosed
-vulnerabilities. Dealing with fixed issues or general questions on how to use
-the security features should be handled regularly via the user and the dev
-lists. Please report any security problems to the project security address
-before disclosing it publicly.
+**Only** use the security contacts to report undisclosed security vulnerabilities in Apache
+Airflow and manage the process of fixing such vulnerabilities. We cannot accept regular
+bug reports or other security-related queries at these addresses. We will ignore mail
+sent to this address that does not relate to an undisclosed security problem
+in the Apache Airflow project. Please follow regular communication channels described in
+the [Airflow Community](https://airflow.apache.org/community/index.html) page for
+inquiries, questions and other discussions related to the process or issues.
+
+Specifically, we will ignore results of security scans that contain list of
Review Comment:
```suggestion
Specifically, we will ignore results of security scans that contain a list of
```
##########
.github/SECURITY.md:
##########
@@ -31,14 +31,25 @@ Airflow specifically offers security features and is responsive to issues
around its features. If you have any concern around Airflow Security or believe
you have uncovered a vulnerability, we suggest that you get in touch via the
e-mail address [security@airflow.apache.org](mailto:security@airflow.apache.org).
-In the message, try to provide a description of the issue and ideally a way of
-reproducing it. The security team will get back to you after assessing the report.
-Note that this security address should be used only for undisclosed
-vulnerabilities. Dealing with fixed issues or general questions on how to use
-the security features should be handled regularly via the user and the dev
-lists. Please report any security problems to the project security address
-before disclosing it publicly.
+**Only** use the security contacts to report undisclosed security vulnerabilities in Apache
+Airflow and manage the process of fixing such vulnerabilities. We cannot accept regular
+bug reports or other security-related queries at these addresses. We will ignore mail
+sent to this address that does not relate to an undisclosed security problem
Review Comment:
```suggestion
**Only** use the security e-mail address to report undisclosed security vulnerabilities in Apache
Airflow and to manage the process of fixing such vulnerabilities. We do not accept regular
bug reports or other security-related queries at this address. We will ignore mail
sent to this address that does not relate to an undisclosed security problem
```
##########
.github/SECURITY.md:
##########
@@ -31,14 +31,25 @@ Airflow specifically offers security features and is responsive to issues
around its features. If you have any concern around Airflow Security or believe
you have uncovered a vulnerability, we suggest that you get in touch via the
e-mail address [security@airflow.apache.org](mailto:security@airflow.apache.org).
-In the message, try to provide a description of the issue and ideally a way of
-reproducing it. The security team will get back to you after assessing the report.
-Note that this security address should be used only for undisclosed
-vulnerabilities. Dealing with fixed issues or general questions on how to use
-the security features should be handled regularly via the user and the dev
-lists. Please report any security problems to the project security address
-before disclosing it publicly.
+**Only** use the security contacts to report undisclosed security vulnerabilities in Apache
+Airflow and manage the process of fixing such vulnerabilities. We cannot accept regular
+bug reports or other security-related queries at these addresses. We will ignore mail
+sent to this address that does not relate to an undisclosed security problem
+in the Apache Airflow project. Please follow regular communication channels described in
+the [Airflow Community](https://airflow.apache.org/community/index.html) page for
+inquiries, questions and other discussions related to the process or issues.
+
+Specifically, we will ignore results of security scans that contain list of
+dependencies of Airflow with dependencies in Airflow Docker reference image - there
+is a page that describes how the
+[Airflow reference Image is fixed at release time](https://airflow.apache.org/docs/docker-stack/index.html#fixing-images-at-release-time)
+and providing helpful instructions explaining how you can build your
+own image and manage dependencies of Airflow in your own image.
+
+**Please send one plain-text email for each vulnerability you are reporting including explanation
Review Comment:
What's the background on why we demand this? I have found it very helpful when images or detailed documents have been included with the report.
##########
.github/SECURITY.md:
##########
@@ -31,14 +31,25 @@ Airflow specifically offers security features and is responsive to issues
around its features. If you have any concern around Airflow Security or believe
you have uncovered a vulnerability, we suggest that you get in touch via the
e-mail address [security@airflow.apache.org](mailto:security@airflow.apache.org).
-In the message, try to provide a description of the issue and ideally a way of
-reproducing it. The security team will get back to you after assessing the report.
-Note that this security address should be used only for undisclosed
-vulnerabilities. Dealing with fixed issues or general questions on how to use
-the security features should be handled regularly via the user and the dev
-lists. Please report any security problems to the project security address
-before disclosing it publicly.
+**Only** use the security contacts to report undisclosed security vulnerabilities in Apache
+Airflow and manage the process of fixing such vulnerabilities. We cannot accept regular
+bug reports or other security-related queries at these addresses. We will ignore mail
+sent to this address that does not relate to an undisclosed security problem
+in the Apache Airflow project. Please follow regular communication channels described in
+the [Airflow Community](https://airflow.apache.org/community/index.html) page for
+inquiries, questions and other discussions related to the process or issues.
+
+Specifically, we will ignore results of security scans that contain list of
+dependencies of Airflow with dependencies in Airflow Docker reference image - there
+is a page that describes how the
+[Airflow reference Image is fixed at release time](https://airflow.apache.org/docs/docker-stack/index.html#fixing-images-at-release-time)
+and providing helpful instructions explaining how you can build your
+own image and manage dependencies of Airflow in your own image.
+
+**Please send one plain-text email for each vulnerability you are reporting including explanation
+how it affects airflow security. We may ask you to resubmit your report if you send it as an image,
+movie, HTML, or PDF attachment when you could as easily describe it with plain text.**
Review Comment:
```suggestion
movie, HTML, or PDF attachment when you could as easily describe it with plain text.**
```
##########
.github/SECURITY.md:
##########
@@ -49,7 +60,11 @@ in other products/circumstances. Therefore, some potential security vulnerabilit
apply to Airflow, or have a different severity than some generic scoring systems (for example `CVSS`)
calculation suggests.
-The [ASF Security team's page](https://www.apache.org/security/) describes
+The security team (see below [Handling security issues in Airflow](https://github.com/apache/airflow/security#handling-security-issues-in-airflow)) will get back to
+you after assessing the report.
Review Comment:
```suggestion
The security team will get back to you after assessing the report (see below [Handling security issues in Airflow](https://github.com/apache/airflow/security#handling-security-issues-in-airflow)).
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] jedcunningham commented on a diff in pull request #32439: Add few clarifications to our security policy
Posted by "jedcunningham (via GitHub)" <gi...@apache.org>.
jedcunningham commented on code in PR #32439:
URL: https://github.com/apache/airflow/pull/32439#discussion_r1258604137
##########
.github/SECURITY.md:
##########
@@ -49,7 +60,11 @@ in other products/circumstances. Therefore, some potential security vulnerabilit
apply to Airflow, or have a different severity than some generic scoring systems (for example `CVSS`)
calculation suggests.
-The [ASF Security team's page](https://www.apache.org/security/) describes
+The security team (see below [Handling security issues in Airflow](https://github.com/apache/airflow/security#handling-security-issues-in-airflow)) will get back to
Review Comment:
```suggestion
The Airflow security team will get back to
```
I say we leave this link out for now. I'm going to open a PR to move that section into another document. I think short/sweet here is a better approach.
##########
.github/SECURITY.md:
##########
@@ -31,14 +31,25 @@ Airflow specifically offers security features and is responsive to issues
around its features. If you have any concern around Airflow Security or believe
you have uncovered a vulnerability, we suggest that you get in touch via the
e-mail address [security@airflow.apache.org](mailto:security@airflow.apache.org).
-In the message, try to provide a description of the issue and ideally a way of
-reproducing it. The security team will get back to you after assessing the report.
-Note that this security address should be used only for undisclosed
-vulnerabilities. Dealing with fixed issues or general questions on how to use
-the security features should be handled regularly via the user and the dev
-lists. Please report any security problems to the project security address
-before disclosing it publicly.
+**Only** use the security contacts to report undisclosed security vulnerabilities in Apache
+Airflow and manage the process of fixing such vulnerabilities. We cannot accept regular
+bug reports or other security-related queries at these addresses. We will ignore mail
+sent to this address that does not relate to an undisclosed security problem
+in the Apache Airflow project. Please follow regular communication channels described in
+the [Airflow Community](https://airflow.apache.org/community/index.html) page for
+inquiries, questions and other discussions related to the process or issues.
+
+Specifically, we will ignore results of security scans that contain list of
+dependencies of Airflow with dependencies in Airflow Docker reference image - there
+is a page that describes how the
+[Airflow reference Image is fixed at release time](https://airflow.apache.org/docs/docker-stack/index.html#fixing-images-at-release-time)
+and providing helpful instructions explaining how you can build your
+own image and manage dependencies of Airflow in your own image.
+
+**Please send one plain-text email for each vulnerability you are reporting including explanation
+how it affects airflow security. We may ask you to resubmit your report if you send it as an image,
+movie, HTML, or PDF attachment when you could as easily describe it with plain text.**
Review Comment:
```suggestion
Please send one plain-text email for each vulnerability you are reporting including explanation
how it affects airflow security. We may ask you to resubmit your report if you send it as an image,
movie, HTML, or PDF attachment when you could as easily describe it with plain text.
```
I don't think we should bold this whole paragraph.
##########
.github/SECURITY.md:
##########
@@ -49,7 +60,10 @@ in other products/circumstances. Therefore, some potential security vulnerabilit
apply to Airflow, or have a different severity than some generic scoring systems (for example `CVSS`)
calculation suggests.
-The [ASF Security team's page](https://www.apache.org/security/) describes
+The security team will get back to you after assessing the report (see below [Handling security issues in Airflow](https://github.com/apache/airflow/security#handling-security-issues-in-airflow)).
Review Comment:
```suggestion
The [Airflow Security Team](https://github.com/apache/airflow/blob/main/CONTRIBUTING.rst#security-team) will get back to you after assessing the report.
```
After #32496, let's do this instead.
##########
.github/SECURITY.md:
##########
@@ -49,7 +60,11 @@ in other products/circumstances. Therefore, some potential security vulnerabilit
apply to Airflow, or have a different severity than some generic scoring systems (for example `CVSS`)
calculation suggests.
-The [ASF Security team's page](https://www.apache.org/security/) describes
+The security team (see below [Handling security issues in Airflow](https://github.com/apache/airflow/security#handling-security-issues-in-airflow)) will get back to
Review Comment:
See #32496.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on a diff in pull request #32439: Add few clarifications to our security policy
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on code in PR #32439:
URL: https://github.com/apache/airflow/pull/32439#discussion_r1258697778
##########
.github/SECURITY.md:
##########
@@ -31,14 +31,25 @@ Airflow specifically offers security features and is responsive to issues
around its features. If you have any concern around Airflow Security or believe
you have uncovered a vulnerability, we suggest that you get in touch via the
e-mail address [security@airflow.apache.org](mailto:security@airflow.apache.org).
-In the message, try to provide a description of the issue and ideally a way of
-reproducing it. The security team will get back to you after assessing the report.
-Note that this security address should be used only for undisclosed
-vulnerabilities. Dealing with fixed issues or general questions on how to use
-the security features should be handled regularly via the user and the dev
-lists. Please report any security problems to the project security address
-before disclosing it publicly.
+**Only** use the security e-mail address to report undisclosed security vulnerabilities in Apache
+Airflow and to manage the process of fixing such vulnerabilities. We do not accept regular
+bug reports or other security-related queries at this address. We will ignore mail
+sent to this address that does not relate to an undisclosed security problem
+in the Apache Airflow project. Please follow regular communication channels described in
+the [Airflow Community](https://airflow.apache.org/community/index.html) page for
+inquiries, questions and other discussions related to the process or issues.
+
+Specifically, we will ignore results of security scans that contain a list of
+dependencies of Airflow with dependencies in Airflow Docker reference image - there
+is a page that describes how the
+[Airflow reference Image is fixed at release time](https://airflow.apache.org/docs/docker-stack/index.html#fixing-images-at-release-time)
+and providing helpful instructions explaining how you can build your
+own image and manage dependencies of Airflow in your own image.
+
+**Please send one plain-text email for each vulnerability you are reporting including an explanation
+of how it affects Airflow security. We may ask that you resubmit your report if you send it as an image,
+movie, HTML, or PDF attachment when you could as easily describe it with plain text.**
Review Comment:
```suggestion
Please send one plain-text email for each vulnerability you are reporting including an explanation
of how it affects Airflow security. We may ask that you resubmit your report if you send it as an image,
movie, HTML, or PDF attachment when you could as easily describe it with plain text.
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] jedcunningham commented on a diff in pull request #32439: Add few clarifications to our security policy
Posted by "jedcunningham (via GitHub)" <gi...@apache.org>.
jedcunningham commented on code in PR #32439:
URL: https://github.com/apache/airflow/pull/32439#discussion_r1258621229
##########
.github/SECURITY.md:
##########
@@ -49,7 +60,11 @@ in other products/circumstances. Therefore, some potential security vulnerabilit
apply to Airflow, or have a different severity than some generic scoring systems (for example `CVSS`)
calculation suggests.
-The [ASF Security team's page](https://www.apache.org/security/) describes
+The security team (see below [Handling security issues in Airflow](https://github.com/apache/airflow/security#handling-security-issues-in-airflow)) will get back to
Review Comment:
See #32496.
##########
.github/SECURITY.md:
##########
@@ -49,7 +60,11 @@ in other products/circumstances. Therefore, some potential security vulnerabilit
apply to Airflow, or have a different severity than some generic scoring systems (for example `CVSS`)
calculation suggests.
-The [ASF Security team's page](https://www.apache.org/security/) describes
+The security team (see below [Handling security issues in Airflow](https://github.com/apache/airflow/security#handling-security-issues-in-airflow)) will get back to
Review Comment:
```suggestion
The Airflow security team will get back to
```
I say we leave this link out for now. I'm going to open a PR to move that section into another document. I think short/sweet here is a better approach.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org