Repository: orc Updated Branches: refs/heads/master 4d8c46ecf -> 3f6a44f3d
Add security page to website. Signed-off-by: Owen O'Malley <[email protected]> Project: http://git-wip-us.apache.org/repos/asf/orc/repo Commit: http://git-wip-us.apache.org/repos/asf/orc/commit/3f6a44f3 Tree: http://git-wip-us.apache.org/repos/asf/orc/tree/3f6a44f3 Diff: http://git-wip-us.apache.org/repos/asf/orc/diff/3f6a44f3 Branch: refs/heads/master Commit: 3f6a44f3df4b54934e1256c65226d396bf71b913 Parents: 4d8c46e Author: Owen O'Malley <[email protected]> Authored: Mon Dec 4 16:38:31 2017 -0800 Committer: Owen O'Malley <[email protected]> Committed: Mon Dec 4 16:38:58 2017 -0800 ---------------------------------------------------------------------- site/index.html | 18 ++++++++++-------- site/security.md | 45 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 55 insertions(+), 8 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/orc/blob/3f6a44f3/site/index.html ---------------------------------------------------------------------- diff --git a/site/index.html b/site/index.html index 4f15884..4e7f43a 100644 --- a/site/index.html +++ b/site/index.html @@ -62,18 +62,20 @@ overview: true <img src="img/asf_logo.png" width="429" height="175" alt="Apache Software Foundation"></a> <div class="pane-content"> - <h2 class="center-on-mobiles">ORC is an <strong>Apache</strong> + <h2 class="center-on-mobiles">ORC is an <strong>Apache</strong> project.</h2> - <p>Apache is a non-profit organization helping open-source - software projects released under the - <a href="https://www.apache.org/licenses/";>Apache License</a> + <p>Apache is a non-profit organization helping open-source + software projects released under the Apache + <a href="https://www.apache.org/licenses/";>license</a> and managed with <a href="https://www.apache.org/foundation/how-it-works.html";> - open governance</a>. We'd like to - <a href="https://www.apache.org/foundation/thanks.html";>thank - </a> the Apache sponsors and encourage others to + open governance</a>. If you discover any + <a href="security.html">security</a> vulnerabilities, please + report them privately. Finally, + <a href="https://www.apache.org/foundation/thanks.html";>thanks + </a> to the sponsors who <a href="https://www.apache.org/foundation/sponsorship.html";> - donate</a>. + donate</a> to the Apache Foundation. </p> </div> </div> http://git-wip-us.apache.org/repos/asf/orc/blob/3f6a44f3/site/security.md ---------------------------------------------------------------------- diff --git a/site/security.md b/site/security.md new file mode 100644 index 0000000..18bc093 --- /dev/null +++ b/site/security.md @@ -0,0 +1,45 @@ +--- +layout: page +title: Security +--- + +Apache ORC is a library rather than an execution framework and thus +is less likely to have security vulnerabilities. However, if you have +discovered one, please follow the process below. + +## Reporting a Vulnerability + +We strongly encourage folks to report security vulnerabilities to our +private security mailing list first, before disclosing them in a +public forum. + +Please note that the security mailing list should only be used for +reporting undisclosed security vulnerabilities in Apache ORC and +managing the process of fixing such vulnerabilities. We cannot accept +regular bug reports or other security related queries at this +address. All mail sent to this address that does not relate to an +undisclosed security problem in Apache ORC will be ignored. + +The ORC security mailing list address is: +<a href="mailto:[email protected]";>[email protected]</a>. +This is a private mailing list and only members of the ORC project +are subscribed. + +Please note that we do not use a team GnuPG key. If you wish to +encrypt your e-mail to [email protected] then please use the GnuPG +keys from [ORC GPG keys](https://people.apache.org/keys/group/orc.asc) for +the members of the +[ORC PMC](https://people.apache.org/phonebook.html?ctte=orc). + +## Vulnerability Handling + +An overview of the vulnerability handling process is: + +* The reporter sends email to the project privately. +* The project works privately with the reporter to resolve the vulnerability. +* The project releases a new version that includes the fix. +* The vulnerability is publically announced via a [CVE](https://cve.mitre.org/). + +## Fixed CVEs + +None. \ No newline at end of file
