lukaszlenart opened a new pull request, #1820: URL: https://github.com/apache/struts/pull/1820
Documents the editorial process for S2-XXX security bulletins as a companion to the existing `triaging-security-reports` skill. Triage establishes what is true; this covers what the published page is allowed to say. This is as much a policy proposal as a tooling change, and the disclosure budget is the part worth PMC review. ## Why Earlier bulletins explained causes and mitigations in enough detail to build working exploits. The project moved away from that, but the rule was never written down — it lived in the heads of whoever happened to be drafting. This records it, and extends it past `Problem` to `Backward compatibility` and `Workaround`, which is where a carefully guarded advisory tends to leak: describing what changed about the fixed behaviour describes the defect. ## What else it records Conventions that were previously tacit, each derived from how recent bulletins are actually written: - **Affected Software** lists voted releases only — never a build that failed its test period, and never a range inferred from git tags, since tags exist for builds that were never voted through - **Ratings** match a definition on the [Security Bulletins](https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=61758) page, which is the only authority: the four-level naming postdates many older advisories, so they cannot be used to calibrate - **Workarounds** are verified in source or not published — including the claim that none exists, which is an assertion about absence and the easiest thing to get wrong - **Behavioural claims** come from the fix diff rather than its commit message, and the fix is confirmed *merged* before publication rather than at drafting time - **Who is not affected** is stated explicitly, because scoping shrinks the population that has to act and costs an attacker nothing they could not read off a dependency list ## Files - `SKILL.md` — the method - `bulletin-template.md` — field reference, per-section guidance, pre-publication checklist, and a storage-format skeleton ready to POST to the Confluence API `bulletin-template.md` is the source of truth for page structure. The restricted wiki template becomes a rendered copy of it, so the process is reviewable here rather than only being visible to `struts-committers`. ## Notes for review - No Jira ticket — process documentation, consistent with how `SECURITY.md`, `AGENTS.md` and `THREAT_MODEL.md` landed - Draft while the wording gets a second read; the disclosure-budget section in particular is the one to argue with - Contains no detail about any unpublished advisory: every worked example is drawn from already-published bulletins 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
