Add baseline security process

[SteveLasker]

Adds a baseline security process.
Note: Majority of the content copied from: https://github.com/helm/helm/blob/main/SECURITY.md

There are still a few todos

• identify a security notifications email list
• establish a set of maintainers of the Verasion project
• establish a set of security maintainers - if these will be different
• create a GOVERNANCE.md file, or redirect the link to ___

Signed-off-by: Steve Lasker stevenlasker@hotmail.com

[thomas-fossati]

Amazing stuff Steve, thanks very much!

The one comment I have is about scope: since this is supposed to apply globally, I think we should create a github.com/veraison/policies repo and move this (and similarly scoped) content there. Then have each repo link the relevant bits.

[SteveLasker]

This is ready for review.
Generalization of changes:

• References the github security process/tab
• Added a private distribution list for public email, privately to a set of security maintainers
• Changed from all of veraison to go-cose, as each sub-project will have its own security tab.

[thomas-fossati]

LGTM, thanks! I left a couple of comments inline.

[SteveLasker]

Thanks @thomas-fossati, I've updated all the feedback.

[thomas-fossati]

🚢 it!

[henkbirkholz]

Well... wouldn't it be cooler, if we set ourselves a deadline, before which we must have reacted and such? You know, in support of responsible disclosure; at the same time warning about the consequences of "wild disclosure"? Or is that out-of-scope?

[henkbirkholz]

Also, full disclosure, after at least two 3rd party code review would be a nice-to-have, so others can learn from mistakes made. Not sure, if we can guarantee the resources for that, though.

[thomas-fossati]

Well... wouldn't it be cooler, if we set ourselves a deadline, before which we must have reacted and such? You know, in support of responsible disclosure; at the same time warning about the consequences of "wild disclosure"? Or is that out-of-scope?

In an ideal world, yes. In the real world it's too risky.

[thomas-fossati]

Also, full disclosure, after at least two 3rd party code review would be a nice-to-have, so others can learn from mistakes made. Not sure, if we can guarantee the resources for that, though.

That's a good aspiration. However, as you also noted, we are not in a position to commit anyone outside the 1st party ring.

[yogeshbdeshpande]

Thank you Steve! LGTM!
Great Job!

[SteveLasker]

Thanks @yogeshbdeshpandec @thomas-fossati, @henkbirkholz

Great to see the finishings come together

[yogeshbdeshpande]

Hmm working on a USA Holiday! Great stuff!