Repository: orc Updated Branches: refs/heads/master 014ee16da -> 5afe60ef5
Refactor security page and fix release page to refer to 1.5. Signed-off-by: Owen O'Malley <[email protected]> Project: http://git-wip-us.apache.org/repos/asf/orc/repo Commit: http://git-wip-us.apache.org/repos/asf/orc/commit/5afe60ef Tree: http://git-wip-us.apache.org/repos/asf/orc/tree/5afe60ef Diff: http://git-wip-us.apache.org/repos/asf/orc/diff/5afe60ef Branch: refs/heads/master Commit: 5afe60ef59d0aebb8cdfb2815883789c29700e07 Parents: 014ee16 Author: Owen O'Malley <[email protected]> Authored: Thu May 17 08:19:01 2018 -0700 Committer: Owen O'Malley <[email protected]> Committed: Thu May 17 08:19:46 2018 -0700 ---------------------------------------------------------------------- site/_docs/releases.md | 2 +- site/index.html | 2 +- site/security.md | 45 --------------------------------------------- site/security/index.md | 45 +++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 47 insertions(+), 47 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/orc/blob/5afe60ef/site/_docs/releases.md ---------------------------------------------------------------------- diff --git a/site/_docs/releases.md b/site/_docs/releases.md index beb4b7a..9f40ca9 100644 --- a/site/_docs/releases.md +++ b/site/_docs/releases.md @@ -17,7 +17,7 @@ reader for ORC files. It also contains tools for working with ORC files and looking at their contents and metadata. {% include release_description.md %} -{% include orc_1.4.md %} +{% include orc_1.5.md %} {% include known_issues.md %} ## Checking signatures http://git-wip-us.apache.org/repos/asf/orc/blob/5afe60ef/site/index.html ---------------------------------------------------------------------- diff --git a/site/index.html b/site/index.html index 4e7f43a..dc04c2a 100644 --- a/site/index.html +++ b/site/index.html @@ -70,7 +70,7 @@ overview: true and managed with <a href="https://www.apache.org/foundation/how-it-works.html";> open governance</a>. If you discover any - <a href="security.html">security</a> vulnerabilities, please + <a href="security/">security</a> vulnerabilities, please report them privately. Finally, <a href="https://www.apache.org/foundation/thanks.html";>thanks </a> to the sponsors who http://git-wip-us.apache.org/repos/asf/orc/blob/5afe60ef/site/security.md ---------------------------------------------------------------------- diff --git a/site/security.md b/site/security.md deleted file mode 100644 index cecbb85..0000000 --- a/site/security.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -layout: page -title: Security ---- - -Apache ORC is a library rather than an execution framework and thus -is less likely to have security vulnerabilities. However, if you have -discovered one, please follow the process below. - -## Reporting a Vulnerability - -We strongly encourage folks to report security vulnerabilities to our -private security mailing list first, before disclosing them in a -public forum. - -Please note that the security mailing list should only be used for -reporting undisclosed security vulnerabilities in Apache ORC and -managing the process of fixing such vulnerabilities. We cannot accept -regular bug reports or other security related queries at this -address. All mail sent to this address that does not relate to an -undisclosed security problem in Apache ORC will be ignored. - -The ORC security mailing list address is: -<a href="mailto:[email protected]";>[email protected]</a>. -This is a private mailing list and only members of the ORC project -are subscribed. - -Please note that we do not use a team GnuPG key. If you wish to -encrypt your e-mail to [email protected] then please use the GnuPG -keys from [ORC GPG keys](https://people.apache.org/keys/group/orc.asc) for -the members of the -[ORC PMC](https://people.apache.org/phonebook.html?ctte=orc). - -## Vulnerability Handling - -An overview of the vulnerability handling process is: - -* The reporter sends email to the project privately. -* The project works privately with the reporter to resolve the vulnerability. -* The project releases a new version that includes the fix. -* The vulnerability is publically announced via a [CVE](https://cve.mitre.org/). - -## Fixed CVEs - -None. \ No newline at end of file http://git-wip-us.apache.org/repos/asf/orc/blob/5afe60ef/site/security/index.md ---------------------------------------------------------------------- diff --git a/site/security/index.md b/site/security/index.md new file mode 100644 index 0000000..cecbb85 --- /dev/null +++ b/site/security/index.md @@ -0,0 +1,45 @@ +--- +layout: page +title: Security +--- + +Apache ORC is a library rather than an execution framework and thus +is less likely to have security vulnerabilities. However, if you have +discovered one, please follow the process below. + +## Reporting a Vulnerability + +We strongly encourage folks to report security vulnerabilities to our +private security mailing list first, before disclosing them in a +public forum. + +Please note that the security mailing list should only be used for +reporting undisclosed security vulnerabilities in Apache ORC and +managing the process of fixing such vulnerabilities. We cannot accept +regular bug reports or other security related queries at this +address. All mail sent to this address that does not relate to an +undisclosed security problem in Apache ORC will be ignored. + +The ORC security mailing list address is: +<a href="mailto:[email protected]";>[email protected]</a>. +This is a private mailing list and only members of the ORC project +are subscribed. + +Please note that we do not use a team GnuPG key. If you wish to +encrypt your e-mail to [email protected] then please use the GnuPG +keys from [ORC GPG keys](https://people.apache.org/keys/group/orc.asc) for +the members of the +[ORC PMC](https://people.apache.org/phonebook.html?ctte=orc). + +## Vulnerability Handling + +An overview of the vulnerability handling process is: + +* The reporter sends email to the project privately. +* The project works privately with the reporter to resolve the vulnerability. +* The project releases a new version that includes the fix. +* The vulnerability is publically announced via a [CVE](https://cve.mitre.org/). + +## Fixed CVEs + +None. \ No newline at end of file
