Update vulnerability-response-runbook.md#48
Conversation
Updates to the vulnerability response runbook: use CVSS instead of OpenSSL to determine severity,
alexcrichton
left a comment
alexcrichton
left a comment
There was a problem hiding this comment.
Looks reasonable to me, but I also think it's fine if we let the living document in our docs be the source fo truth rather than also updating here, too. Although maybe this could link to say the most up-to-date version is there too?
tschneidereit
left a comment
tschneidereit
left a comment
There was a problem hiding this comment.
Looks good to me, too. Though I also agree with Alex that it might be better to just add a note here that the up-to-date version of the runbook lives elsewhere, since RFCs aren't really meant to be living documents (sorta for better and worse.)
| Wasmtime has committed that security issues will be applied to the current major | ||
| version of Wasmtime, the previous major version, and the previous two LTS releases | ||
| (i.e. those whose major version is divisible by 12). See the [Wasmtime LTS RFC] | ||
| for more details and [release process] docs for the current set of supported releases. | ||
|
|
||
| Other projects without an existing policy should do the same, unless they have | ||
| a very good reason for issuing backports. | ||
| [Wasmtime LTS RFC]: https://github.com/bytecodealliance/rfcs/blob/main/accepted/wasmtime-lts.md | ||
| [release process]: https://docs.wasmtime.dev/stability-release.html#release-process |
There was a problem hiding this comment.
It might make sense to leave out the details here, replacing them with more generic language about projects choosing and documenting their release support policy, and then committing to patching all supported releases. That could come with a link to Wasmtime's release process doc as an example.
|
I updated this because I went looking for the runbook and forgot that the living copy was in the wasmtime docs, so I filled out these fixes before I actually found the wasmtime one. Will close this and just insert a notice at the top to redirect to the living document. |
3 participants
Updates to the vulnerability response runbook: