8340954: Add SECURITY.md file

[kevinrushforth]

A SECURITY.md file was recently added to the jdk repo. GitHub will show that policy if you click on the "Security" tab of the jdk repo -- If you are logged in, you may need to further click on the "Policy" tab.

We need a copy of this file in the jfx repo, so that similarly, you will see the policy if you click on the "Security" tab of the jfx repo -- if you are logged in, you may need to further click on the "Policy" tab.

The SECURITY.md file in this PR is identical to the one in the jdk repo, with "JDK" replaced by "JavaFX" in two places (the section header and the name of the software).

See openjdk/jdk#21155 for more details.

---

Progress

• Change must be properly reviewed (1 review required, with at least 1 Reviewer)
• Change must not contain extraneous whitespace
• Commit message must refer to an issue

Issue

• JDK-8340954: Add SECURITY.md file (Enhancement - P4)

Reviewers

• Andy Goryachev (@andy-goryachev-oracle - Reviewer)
• Marius Hanl (@Maran23 - Committer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jfx.git pull/1578/head:pull/1578
$ git checkout pull/1578

Update a local copy of the PR:
$ git checkout pull/1578
$ git pull https://git.openjdk.org/jfx.git pull/1578/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 1578

View PR using the GUI difftool:
$ git pr show -t 1578

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jfx/pull/1578.diff

Webrev

Link to Webrev Comment

[bridgekeeper]

👋 Welcome back kcr! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

[openjdk]

@kevinrushforth This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8340954: Add SECURITY.md file

Reviewed-by: angorya, mhanl

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been no new commits pushed to the master branch. If another commit should be pushed before you perform the /integrate command, your PR will be automatically rebased. If you prefer to avoid any potential automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

[mlbridge]

Webrevs

• 00: Full (7b0fdb57)

[andy-goryachev-oracle]

since FX is not technically a part of JDK, should it point to a separate (new) page instead of https://openjdk.org/groups/vulnerability/report ?

[kevinrushforth]

No. JavaFX is part of OpenJDK. It is irrelevant whether or not it happens to be bundled with the JDK.

[andy-goryachev-oracle]

+1

[Maran23]

+1, I think this is a good idea for both the JDK and JavaFX, as people who work primarily with Github will immediately find relevant security information in the relevant project.

[kevinrushforth]

/integrate

[openjdk]

Going to push as commit 0dd0c79.

[openjdk]

@kevinrushforth Pushed as commit 0dd0c79.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

[kevinrushforth]

/backport jfx23u

[openjdk]

@kevinrushforth the backport was successfully created on the branch backport-kevinrushforth-0dd0c794-master in my personal fork of openjdk/jfx23u. To create a pull request with this backport targeting openjdk/jfx23u:master, just click the following link:

➡️ Create pull request

The title of the pull request is automatically filled in correctly and below you find a suggestion for the pull request body:

Hi all,

This pull request contains a backport of commit 0dd0c794 from the openjdk/jfx repository.

The commit being backported was authored by Kevin Rushforth on 26 Sep 2024 and was reviewed by Andy Goryachev and Marius Hanl.

Thanks!

If you need to update the source branch of the pull then run the following commands in a local clone of your personal fork of openjdk/jfx23u:

$ git fetch https://github.com/openjdk-bots/jfx23u.git backport-kevinrushforth-0dd0c794-master:backport-kevinrushforth-0dd0c794-master
$ git checkout backport-kevinrushforth-0dd0c794-master
# make changes
$ git add paths/to/changed/files
$ git commit --message 'Describe additional changes made'
$ git push https://github.com/openjdk-bots/jfx23u.git backport-kevinrushforth-0dd0c794-master