[PR] docs(skills): send CVE advisory mails from the ASF CVE tool [struts]

["lukaszlenart (via GitHub)" <gi...@apache.org>]

lukaszlenart opened a new pull request, #1851:
URL: https://github.com/apache/struts/pull/1851

   Follow-up to feedback from sebb and raboof on the [S2-073 announcement thread](https://lists.apache.org/thread/jy7z5qfv19o3lfjh5315lkd0n5jzvvjb).
   
   ## What prompted this
   
   The S2-070…S2-074 advisory mails were sent by hand from Gmail on 2026-08-14. The *bodies* were already the CVE tool's generated text — only the sending was hand-rolled, and that is where every failure came from:
   
   | Send | Outcome |
   |---|---|
   | S2-070, from the personal Gmail identity | Bounced — `Must be sent from an @apache.org address.` |
   | S2-071…074, to `user@` with `announce@` in Cc/Bcc | Bounced — `unacceptable MIME Content-Type: 'text/html' (#5.2.3)` |
   | The re-sends, to `announce@` alone | Delivered, subjects hand-prefixed `[ANN] ` |
   
   raboof asked why the `Send these Emails` button on `cveprocess.apache.org` wasn't used. sebb noted that ASF CVE reports don't carry an `[ANN]` prefix, and that mail sent through the tool is moderated automatically while a personal account waits for a human moderator.
   
   ## The actual cause
   
   `CNA_private.userslist` on the Struts records reads `dev@struts.apache.org`. That field is labelled *"This is your project list such as users@ where you also want security announcement emails go to"* — so the tool's generated ASF mail addressed `announce@apache.org, dev@struts.apache.org` and missed `user@struts.apache.org`, the list operators actually read. That is why the button looked inadequate and hand-sending looked necessary. It is a one-field fix.
   
   (`CNA_private.emailed` is still `null` on all five records, confirming the button was never pressed.)
   
   ## Changes
   
   - **`creating-security-bulletins/SKILL.md`** — the announcement section becomes an ordered four-step recipe ending in `Press Send these Emails`, with the `userslist` fix as step 1. The Gmail path is demoted from a co-equal alternative to a conditional keyed to the button actually failing. Adds the subject rule (take the tool's `CVE-YYYY-NNNNN: Apache Struts: …` unedited — no `[ANN]`, no `- S2-XXX` suffix) and a note that moderation delay is not a failed send.
   - **`bulletin-template.md`** — `userslist` added to the pre-publication checklist.
   - **`releasing-struts/`** — phase 7 gate and runbook updated to point at the button, and the release `[ANN]` mail is explicitly guarded so the prefix isn't stripped from the wrong mail.
   
   The old text already said "use the tool's mails" and then documented a complete Gmail recipe underneath — the fallback is what got taken under time pressure. This replaces the recommendation with a recipe rather than adding another prohibition.
   
   ## Testing
   
   Not tested against the live tool, deliberately: modifying an already-published CVE record is prohibited, and reserving a CVE that isn't needed is too. This will be exercised on the next advisory that needs one. Draft until then.
   
   Every fact here was read off the tool on 2026-08-15 (read-only — no record was modified and no mail was sent).
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] docs(skills): send CVE advisory mails from the ASF CVE tool [struts]

["lukaszlenart (via GitHub)" <gi...@apache.org>]

lukaszlenart merged PR #1851:
URL: https://github.com/apache/struts/pull/1851


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org