[PR] Register the Allura, Ignite 2 and Kvrocks Controller security models [security-site]

["ppkarwasz (via GitHub)" <gi...@apache.org>]

ppkarwasz opened a new pull request, #99:
URL: https://github.com/apache/security-site/pull/99

   Stacked on #98 — review that one first; this PR's own changes are the last two commits.
   
   A review of `scripts/project-coordinates.json` turned up three threat-model coordinates that were missing or pointed at the wrong product. Every link below was checked against the live repositories.
   
   **Apache Allura** — `apache/allura` ships a `SECURITY.md` on its default branch that is a genuine scope statement (Site Admins and Neighborhood Admins are trusted roles, HTTP issues must be reproduced against the full stack, default-disabled features such as the Trac importer are out of scope), but no model was registered, so the project showed none.
   
   **Apache Ignite** — the only registered model was the Ignite 3 one, whose text states that authorization (RBAC, permissions) "is not yet implemented" and that all authenticated users have equivalent access. Ignite 2.x is a separate product with its own published security model, and it is the code most Ignite advisories are filed against. The PMC entry now carries the Ignite 2.x model, and Ignite 3 is listed as a project of its own, so a reporter sees which model covers which product.
   
   **Apache Kvrocks** — `apache/kvrocks/THREAT_MODEL.md` explicitly scopes itself to the server and defers the cluster control plane to `apache/kvrocks-controller`, which publishes a threat model of its own. That model was not registered anywhere, so the control plane appeared to be covered by the server model. It is now listed as a project of the PMC.
   
   Commits are split so the data change stays readable: one for `scripts/project-coordinates.json`, one for the regenerated pages. The regeneration uses the same advisory data as #98, so the page diff here is limited to the model links.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@security.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Register the Allura, Ignite 2 and Kvrocks Controller security models [security-site]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #99:
URL: https://github.com/apache/security-site/pull/99


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@security.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org