From fcc9b5ec7c2eab3ac4080874a9754cc89a580cf4 Mon Sep 17 00:00:00 2001 From: Yannik Fuhrmeister Date: Tue, 30 Mar 2021 19:04:55 +0200 Subject: [PATCH 1/5] Release And Bugfixing Strategy We had a discussion about our release management and these are the main points we want to clarify Signed-off-by: Yannik Fuhrmeister --- CONTRIBUTING.md | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 22df330959..dd0f72fb57 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -8,6 +8,28 @@ - [How to Write Commit Messages](#how-to-write-commit-messages) - [Code of Conduct](#code-of-conduct) +## Release Strategy + +Our Release Cycle for new Features (Minior semver update) +is roughly every two weeks (We will usually make a new Release after each Review). + +### Major Release (Semver) + +For Upcomming major updates we decided that there will be a time window in which both Major versions (starting with v2.x.x) +will receive security updates and bugfixes. +We did not yet decide on the size window but it will probably be a couple of months +and will be published when the next major version will be released. + +### Minor Release/Feature Releases (Semver) + +We currently plan to provide support for the latest Minor semver release only. + +### Patch Release/Bugfix/Security Fix + +We try to make bugfixes and high severity fixes available as patch release for the current minor release +as early as possible. + + ## GitHub Flow For more information see [GitHub Flow](https://githubflow.github.io/) @@ -54,6 +76,20 @@ When you are done, you can convert it to a standard *Pull Request* (or create on Generally the _secureCodeBox_ project follows the standard [GitHub Pull request process](https://docs.github.com/en/github/collaborating-with-issues-and-pull-requests/about-pull-requests). +## Bugfixing And Securityfixing Released Features + +For Bugfixes and security fixes of the current release please follow the following workflow: +- For the minor release + - Checkout current minor release branch (e.g. v2.5.x) or create if not existent from latest git tag + - Create a bugfix branch from release branch + - Fix Bug + - Create PR to release branch + - Generate new semver release +- For the main branch: + - Create a bugfix branch from `main` branch + - Cherry-Pick Bugfix and commit to bugfix branch + - Create PR to `main` branch + ## Working with Issues/How to Contribute in Issues It is mandatory to open an issue, if the task takes longer than one hour. From b2b92c734c199c6786e6efd8080a6120f51cf30b Mon Sep 17 00:00:00 2001 From: Robert Seedorff Date: Tue, 30 Mar 2021 23:10:02 +0200 Subject: [PATCH 2/5] Adding SECURITY.md template to explain our project specific support strategie (WIP). --- SECURITY.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000000..42d2c834a2 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,17 @@ +# Security Policy + +## Supported Versions +Use this section to tell people about which versions of your project are currently being supported with security updates. + +| Version | Security Fixes* | Supported** | +| ------- | ------------------ | ------------------ | +| 2.6.x-alpha1 | :white_check_mark: | :white_check_mark: | +| 2.5.x | :white_check_mark: | :white_check_mark: | +| <= 2.4.x | :x: | :x: | +| < 2.0 | :x: | :x: | + +## Extended Support +Use this section to tell people about the possibilities to get (payed) extended support for older versions with security updates of your project are currently being supported. + +## Reporting a Vulnerability +Use this section to tell people how to report a vulnerability.Tell them where to go, how often they can expect to get an update on areported vulnerability, what to expect if the vulnerability is accepted ordeclined, etc. From c784226cdcfb4cb57f7723aa624a62260b43679a Mon Sep 17 00:00:00 2001 From: Robert Seedorff Date: Wed, 31 Mar 2021 22:58:45 +0200 Subject: [PATCH 3/5] Moved support explanations to security.md. --- CONTRIBUTING.md | 25 ++----------------------- SECURITY.md | 26 ++++++++++++++++++++++---- 2 files changed, 24 insertions(+), 27 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index dd0f72fb57..c9eff91a9d 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -4,32 +4,11 @@ - [GitHub Flow](#github-flow) - [How to work with GitHub Flow](#how-to-work-with-github-flow) - [Working with Forks and Pull Requests](#working-with-forks-and-pull-requests) - - [Working with Issues / How to Contribute in Issues](#working-with-issues--how-to-contribute-in-issues) + - [Bugfixing And Securityfixing Released Features](#bugfixing-and-securityfixing-released-features) + - [Working with Issues/How to Contribute in Issues](#working-with-issueshow-to-contribute-in-issues) - [How to Write Commit Messages](#how-to-write-commit-messages) - [Code of Conduct](#code-of-conduct) -## Release Strategy - -Our Release Cycle for new Features (Minior semver update) -is roughly every two weeks (We will usually make a new Release after each Review). - -### Major Release (Semver) - -For Upcomming major updates we decided that there will be a time window in which both Major versions (starting with v2.x.x) -will receive security updates and bugfixes. -We did not yet decide on the size window but it will probably be a couple of months -and will be published when the next major version will be released. - -### Minor Release/Feature Releases (Semver) - -We currently plan to provide support for the latest Minor semver release only. - -### Patch Release/Bugfix/Security Fix - -We try to make bugfixes and high severity fixes available as patch release for the current minor release -as early as possible. - - ## GitHub Flow For more information see [GitHub Flow](https://githubflow.github.io/) diff --git a/SECURITY.md b/SECURITY.md index 42d2c834a2..c0279c9e08 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,7 +1,8 @@ # Security Policy ## Supported Versions -Use this section to tell people about which versions of your project are currently being supported with security updates. +Our _release cycle_ for new features (minior [semver](https://semver.org/lang/de/) update) +is roughly every two weeks (we will usually make a new release after each review). | Version | Security Fixes* | Supported** | | ------- | ------------------ | ------------------ | @@ -10,8 +11,25 @@ Use this section to tell people about which versions of your project are current | <= 2.4.x | :x: | :x: | | < 2.0 | :x: | :x: | -## Extended Support -Use this section to tell people about the possibilities to get (payed) extended support for older versions with security updates of your project are currently being supported. +### Major Release (Semver) +_Upcoming major updates_ will come with a time window in which both _major versions_ (starting with v2.x.x) +will receive security updates and bugfixes. The concrete support intervall will be probably a couple of months +and will be published when the next major version will be released. + +### Minor Release/Feature Releases (Semver) +We currently plan to provide support for the _latest minor [semver](https://semver.org/lang/de/)_ release only. + +### Patch Release/Bugfix/Security Fix +We try to make bugfixes and high severity fixes available as patch release for the current minor release +as early as possible. + +## Extended (Enterprise) Support +If you are interessted in extended support for older versions with security updates of our project +please get in touch with the project team via Slack or eMail . ## Reporting a Vulnerability -Use this section to tell people how to report a vulnerability.Tell them where to go, how often they can expect to get an update on areported vulnerability, what to expect if the vulnerability is accepted ordeclined, etc. +You have found a vulnerability in the project that shouldndt be discloused as public issue before its fixed? +Please get in touch with the project team via Slack or eMail . + +You can expect a fast reaction within the next days. +We will keep you updated about the next steps and inform you if the vulnerability is accepted and when its fixed or if its ordeclined somehow. From 7ceeb5cef7545c9777f056d19c59c373f2de3d9c Mon Sep 17 00:00:00 2001 From: Robert Seedorff Date: Sat, 10 Apr 2021 22:31:41 +0200 Subject: [PATCH 4/5] Fixing typos. --- SECURITY.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index c0279c9e08..163b28fbb4 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,7 +1,7 @@ # Security Policy ## Supported Versions -Our _release cycle_ for new features (minior [semver](https://semver.org/lang/de/) update) +Our _release cycle_ for new features (minior [semver](https://semver.org/) update) is roughly every two weeks (we will usually make a new release after each review). | Version | Security Fixes* | Supported** | @@ -17,19 +17,19 @@ will receive security updates and bugfixes. The concrete support intervall will and will be published when the next major version will be released. ### Minor Release/Feature Releases (Semver) -We currently plan to provide support for the _latest minor [semver](https://semver.org/lang/de/)_ release only. +We currently plan to provide support for the _latest minor [semver](https://semver.org/)_ release only. ### Patch Release/Bugfix/Security Fix We try to make bugfixes and high severity fixes available as patch release for the current minor release as early as possible. ## Extended (Enterprise) Support -If you are interessted in extended support for older versions with security updates of our project -please get in touch with the project team via Slack or eMail . +If you are interested in extended support for older versions with security updates of our project +please get in touch with the project team via Slack or email . ## Reporting a Vulnerability -You have found a vulnerability in the project that shouldndt be discloused as public issue before its fixed? -Please get in touch with the project team via Slack or eMail . +You have found a vulnerability in the project that shouldn't be disclosed as public issue before it's fixed? +Please get in touch with the project team via Slack or email . You can expect a fast reaction within the next days. We will keep you updated about the next steps and inform you if the vulnerability is accepted and when its fixed or if its ordeclined somehow. From c57f06db23be216aaaa2377ce75d864699acf9ea Mon Sep 17 00:00:00 2001 From: Robert Seedorff Date: Sat, 10 Apr 2021 22:36:58 +0200 Subject: [PATCH 5/5] Fixing typos. --- CONTRIBUTING.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index c9eff91a9d..a1aa3a670c 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -4,8 +4,8 @@ - [GitHub Flow](#github-flow) - [How to work with GitHub Flow](#how-to-work-with-github-flow) - [Working with Forks and Pull Requests](#working-with-forks-and-pull-requests) - - [Bugfixing And Securityfixing Released Features](#bugfixing-and-securityfixing-released-features) - - [Working with Issues/How to Contribute in Issues](#working-with-issueshow-to-contribute-in-issues) + - [Bugfixing and Security Fixing Released Features](#bugfixing-and-security-fixing-released-features) + - [Working with Issues - How to Contribute in Issues](#working-with-issues---how-to-contribute-in-issues) - [How to Write Commit Messages](#how-to-write-commit-messages) - [Code of Conduct](#code-of-conduct) @@ -55,9 +55,9 @@ When you are done, you can convert it to a standard *Pull Request* (or create on Generally the _secureCodeBox_ project follows the standard [GitHub Pull request process](https://docs.github.com/en/github/collaborating-with-issues-and-pull-requests/about-pull-requests). -## Bugfixing And Securityfixing Released Features +## Bugfixing and Security Fixing Released Features -For Bugfixes and security fixes of the current release please follow the following workflow: +For bugfixes and security fixes of the current release please follow the following workflow: - For the minor release - Checkout current minor release branch (e.g. v2.5.x) or create if not existent from latest git tag - Create a bugfix branch from release branch @@ -69,7 +69,7 @@ For Bugfixes and security fixes of the current release please follow the followi - Cherry-Pick Bugfix and commit to bugfix branch - Create PR to `main` branch -## Working with Issues/How to Contribute in Issues +## Working with Issues - How to Contribute in Issues It is mandatory to open an issue, if the task takes longer than one hour. Before you open an issue please verify there is no existing one covering your issue.