Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

proposals: add release-approval-process #15

Closed
wants to merge 18 commits into from
Closed

proposals: add release-approval-process #15

Changes from 1 commit
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
bdfa70d
proposals: add release-approval-process
Jun 9, 2016
1e3b643
proposal: release-approval-process add some motivation
Jun 10, 2016
66fce91
proposals: release approval process to one week for apps
Jun 14, 2016
da906b9
proposals: release approval process 3 rcs required
Jun 14, 2016
b01dc6c
proposals: release approval process: one month pre-releases
Jun 14, 2016
ff453b6
proposals: release approval process: use consistent language for rejects
Jun 14, 2016
86a3255
proposals: release approval process: clarify utility of GitHub
Jun 14, 2016
d6a6dbe
proposals: release-approval-process: add voting members language
Jun 14, 2016
33d5a19
proposals: release approval process: add quorum language
Jun 15, 2016
78d6c1e
proposals: release approval process: add language about mailing list
Jun 15, 2016
4206adb
proposals: release approval process: add information to projects
Jun 15, 2016
abd3704
proposals: release approval process: improve REJECT feedback
Jun 15, 2016
fb003ff
proposals: release-approval-process: fixup additional typos
Jun 16, 2016
77305d8
release-approval: Shuffle to make more DRY
wking Jun 16, 2016
ebae4ac
release-approval: Add non-spec unanimous quorum reduction
wking Jun 17, 2016
7599a0f
proposals: release-approval-process fix a grammar thing
Jun 22, 2016
9553cfe
proposal: fix a typo
Jun 22, 2016
37088fb
proposals: release approval process explain security@ email
Jun 25, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion proposals/release-approval-process.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ OCI projects need a standard process for making releases so the community of mai

## Security fixes

Security fix releases MUST use [email protected] instead of [email protected], but should otherwise follow the standard [list-based voting process](#list-based-voting).
Security fix releases MUST use [email protected] instead of [email protected], but should otherwise follow the standard [list-based voting process](#list-based-voting). The [email protected] email includes all members of the TOB; the TOB will guide the security sensitive release with project maintainers.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tried to flesh this out a bit in philips#2, but I'm concerned about two things:

  • If you pull in the TOB, you have to explain how the TOB and maintainers will interact (i.e. what does “guide” mean in your sentence?). I'd rather just have {project}+security@ addresses (e.g. [email protected]), and the maintainers can pull in the TOB as they see fit (like always).
  • Who gets advanced notification of security fixes? Do folks who want advanced access apply by mailing the security address? E.g. “please let us know before pushing security fixes so we can patch our system. We have $N users, and you can trust us not to leak/abuse the information because $REASONS”. Where is the list of approved early-contacts maintained (probably not in the public project repo)?


## Parallel proposals

Expand Down