(axis-axis2-c-core) branch master updated: Add Github Actions tool cve-check

[ro...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git


The following commit(s) were added to refs/heads/master by this push:
     new f7d0153fa Add Github Actions tool cve-check
f7d0153fa is described below

commit f7d0153fa617ac64e66fc08fda9821437611e768
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Sun Feb 1 04:58:31 2026 -1000

    Add Github Actions tool cve-check
---
 docs/SECURITY.md | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/docs/SECURITY.md b/docs/SECURITY.md
index a8ae11e1c..b78646338 100644
--- a/docs/SECURITY.md
+++ b/docs/SECURITY.md
@@ -601,6 +601,44 @@ pkg-config --modversion libnghttp2
 - Use distribution packages where possible (apt, yum) for automatic security updates
 - Subscribe to security mailing lists for critical dependencies
 
+### CVE Monitoring (Library Responsibility)
+
+Axis2/C maintains a **monthly CVE checker** via GitHub Actions (`.github/workflows/cve-check.yml`) that:
+
+1. Queries NVD for CVEs affecting Axis2/C dependencies
+2. Creates GitHub issues when new CVEs are discovered
+3. Triggers updates to the minimum versions table above
+
+**Responsibility Chain:**
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│  Axis2/C (Library) - This Repository                        │
+│  ─────────────────────────────────────────                  │
+│  • Monthly CVE checker monitors dependencies                │
+│  • Maintainers update SECURITY.md minimum versions          │
+│  • Advisory: "Use OpenSSL 3.2.1+ for CVE-XXXX"              │
+│                          │                                  │
+│                          ▼                                  │
+│  All downstream applications see the advisory               │
+└─────────────────────────────────────────────────────────────┘
+                           │
+                           ▼
+┌─────────────────────────────────────────────────────────────┐
+│  Downstream Applications (e.g., Kanaha)                     │
+│  ─────────────────────────────────────                      │
+│  • OWASP Dependency-Check scans actual build artifacts      │
+│  • CI fails if critical CVEs exist in shipped binaries      │
+│  • Developers rebuild deps and release patched versions     │
+└─────────────────────────────────────────────────────────────┘
+```
+
+**Why this model:**
+- Axis2/C is distributed as source code (no binaries since 2009)
+- Library maintainers track CVEs and advise minimum versions
+- Application maintainers (who ship binaries) act on CVE findings
+- Separation of "awareness" (library) from "action" (application)
+
 ## WS-Security (Rampart)
 
 Axis2/C supports WS-Security through the Apache Rampart/C module, which provides: