Add and correct verified threat-model links in project-coordinates.json#74
Open
potiuk wants to merge 6 commits into
Open
Add and correct verified threat-model links in project-coordinates.json#74potiuk wants to merge 6 commits into
potiuk wants to merge 6 commits into
Conversation
Populate and correct security_model_link / security_model_source for 66 PMCs whose threat models the ASF Security team has verified, and add Commons-style projects[] arrays for 9 multi-repo PMCs (axis, freemarker, grails, jackrabbit, polaris, superset, teaclave, trafficserver, ws). Every URL was deterministically verified to resolve: 72 GitHub files via the contents API and 9 project-site pages. This fixes several stale entries that pointed at GitHub's /security/policy tab or non-existent paths (e.g. apisix pointed at a root THREAT_MODEL.md that does not exist; its model lives under docs/en/latest/). Adds advisory_link: null to the camel entry to satisfy the schema. Generated-by: Claude Opus 4.8 (1M context)
potiuk
marked this pull request as ready for review
July 21, 2026 13:46
raboof
reviewed
Jul 22, 2026
| "name": "Apache DolphinScheduler", | ||
| "security_model_link": "https://github.com/apache/dolphinscheduler/blob/dev/docs/docs/en/contribute/join/security.md", | ||
| "security_model_source": "https://raw.githubusercontent.com/apache/dolphinscheduler/dev/docs/docs/en/contribute/join/security.md", | ||
| "security_model_link": "https://github.com/apache/dolphinscheduler/blob/dev/docs/docs/en/contribute/join/security-model.md", |
Member
There was a problem hiding this comment.
here security.md tells the user how to report issues and links to security-model.md which has the details on the security model. I think linking to security.md is more helpful, otherwise it's unclear how to report issues.
Member
There was a problem hiding this comment.
For the purpose of the pages that are generated, I think a direct link to security-model.md is the better choice. Reporting instructions are already published on security.apache.org and the generated page only captures the differences: security contact and model.
| "spark": { | ||
| "name": "Apache Spark", | ||
| "security_model_link": "https://spark.apache.org/security.html", | ||
| "security_model_link": "https://spark.apache.org/docs/latest/security.html", |
Member
There was a problem hiding this comment.
https://spark.apache.org/security.html has additional information and already links to https://spark.apache.org/docs/latest/security.html
Strip the redundant refs/heads/ segment from all security_model_source links, as requested in PR apache#74 review. All 87 raw URLs in the file were verified to still resolve with HTTP 200. Assisted-By: Claude Fable 5 <noreply@anthropic.com>
Point security_model_link back at camel.apache.org as requested in PR apache#74 review; the GitHub source stays in security_model_source. The rendered page was verified to resolve with HTTP 200. Assisted-By: Claude Fable 5 <noreply@anthropic.com>
When security_model_source is the repository's SECURITY.md on its default branch, point security_model_link at the GitHub security/policy tab, which renders the same file more cleanly. Converts 13 blob links (fineract, freemarker, impala, parquet-java, pdfbox, superset, tomee, trafficserver and the axis, freemarker and trafficserver sub-projects); baremaps, hadoop, httpd, paimon and pulsar already followed this convention. Each source branch was checked to be the repository default and all 18 policy pages resolve with HTTP 200. Assisted-By: Claude Fable 5 <noreply@anthropic.com>
WSS4J is one of the projects under the Web Services PMC, so its threat model belongs in the projects array next to Axiom, XmlSchema and Neethi rather than at the PMC level, as noted in PR apache#74 review. The URLs are unchanged. Assisted-By: Claude Fable 5 <noreply@anthropic.com>
Knox documents its threat model in THREAT_MODEL.md on the default branch; the raw URL was verified to resolve with HTTP 200. Assisted-By: Claude Fable 5 <noreply@anthropic.com>
ppkarwasz
approved these changes
Jul 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Populates and corrects
security_model_link/security_model_sourcefor 66 PMCs whose threat models the ASF Security team has verified, and adds Commons-styleprojects[]arrays for 9 multi-repo PMCs (axis,freemarker,grails,jackrabbit,polaris,superset,teaclave,trafficserver,ws).Every URL was deterministically verified to resolve: 72 GitHub files via the contents API and 9 project-site pages.
Notable fixes to stale/incorrect entries:
apisixpointed at a rootTHREAT_MODEL.mdthat does not exist — the model lives underdocs/en/latest/security-threat-model.md.activemq,fineract,impala,superset,trafficserverpointed at GitHub's/security/policytab rather than the actual model file.camel,cassandra,dolphinscheduler,jackrabbit,kafka,pdfbox,shiro,solr,spark,tomcatpointed at CVE-list / disclosure-policy pages rather than the threat model.Also adds
advisory_link: nullto thecamelentry so the file validates againstproject-coordinates.schema.json(pre-existing gap).