Reports should be encrypted to the shared key published for [email protected], not to individual team members. Document the fingerprint and how to fetch it via WKD.
Signed-off-by: Stephen Hemminger <[email protected]> --- doc/guides/contributing/vulnerability.rst | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/doc/guides/contributing/vulnerability.rst b/doc/guides/contributing/vulnerability.rst index 9a0684df22..d07662d51e 100644 --- a/doc/guides/contributing/vulnerability.rst +++ b/doc/guides/contributing/vulnerability.rst @@ -41,6 +41,17 @@ This address is open to all, but access to its inbox is intentionally limited to a small group to minimize the risk of early disclosure. +Encrypt the report to the DPDK security team key for [email protected], +with fingerprint:: + + 912D 9514 04F5 D8CE 36C7 A338 7305 BE09 7E37 712D + +The key is published through WKD and can be retrieved with:: + + gpg --locate-external-keys [email protected] + +Check the fingerprint above before using the key. + GPG-sign any one-on-one correspondence related to the vulnerability report as part of maintaining a secure communication process. -- 2.53.0
