[RESULT] was Re: [VOTE] commit Low/Moderate severity security issues to public repos
OK, this has run a week. I'm going to infer that people voting for "Low+Moderate" are also OK with just "Low", and the PMC votes were as follows: No: (0 votes) Low: covener, steffenal, rpluem, jorton, jclere, rjung, jailletc36, thumbs (8 votes) Low+Moderate: covener, steffenal, jorton, jclere, rjung, thumbs (6 votes) The majority is for handling only Low severity issues via obfuscated commits, and we continue with the current process for everything else. Thanks all. Regards, Joe
Re: [VOTE] commit Low/Moderate severity security issues to public repos
On Tue, May 12, 2026 at 4:24 PM Christophe JAILLET < [email protected]> wrote: > > Le 08/05/2026 à 13:31, Joe Orton a écrit : > > Hi all, another vote - > > > > We currently track all security issues in private, pushing these to the > > public repos only during the preparation for a release. This adds > > significant overhead for committers handling the current surge of > > reports - a surge which mostly comprises Low severity issues. It also > > delays us getting CI runs, which potentially delays the release, exactly > > as happened with the recent mod_auth_digest fix in 2.4.67. > > > > I'm proposing that we change the process: once we confirm a Low (and > > maybe Moderate) severity issue, the fix can be pushed to the public > > repos like any other change, with a deliberately obfuscated commit > > message to conceal the security impact. The ASF Security team is fine > > with this approach per [1], though cautions us to not keep the obscured > > commits public for too long before a release. > > > > Please vote: > > > > [ ] No - keep the current process > > [X] Yes - push Low severity issues as obfuscated public commits > > [ ] Yes - push Low+Moderate severity issues as obfuscated public commits > > > > If you're fine with either Low or Low+Moderate vote "Yes" on both and > > we'll see where the majority lies? > > > > Regards, Joe > > > > [1] > https://cwiki.apache.org/confluence/display/SECURITY/Working+In+Private > > > I was initially wary of the third option, but I reconsidered the risks. [x ] Yes - push Low severity issues as obfuscated public commits [x ] Yes - push Low+Moderate severity issues as obfuscated public commits
Re: [VOTE] commit Low/Moderate severity security issues to public repos
Le 08/05/2026 à 13:31, Joe Orton a écrit : Hi all, another vote - We currently track all security issues in private, pushing these to the public repos only during the preparation for a release. This adds significant overhead for committers handling the current surge of reports - a surge which mostly comprises Low severity issues. It also delays us getting CI runs, which potentially delays the release, exactly as happened with the recent mod_auth_digest fix in 2.4.67. I'm proposing that we change the process: once we confirm a Low (and maybe Moderate) severity issue, the fix can be pushed to the public repos like any other change, with a deliberately obfuscated commit message to conceal the security impact. The ASF Security team is fine with this approach per [1], though cautions us to not keep the obscured commits public for too long before a release. Please vote: [ ] No - keep the current process [X] Yes - push Low severity issues as obfuscated public commits [ ] Yes - push Low+Moderate severity issues as obfuscated public commits If you're fine with either Low or Low+Moderate vote "Yes" on both and we'll see where the majority lies? Regards, Joe [1] https://cwiki.apache.org/confluence/display/SECURITY/Working+In+Private
Re: [VOTE] commit Low/Moderate severity security issues to public repos
Am 08.05.26 um 13:31 schrieb Joe Orton: Hi all, another vote - We currently track all security issues in private, pushing these to the public repos only during the preparation for a release. This adds significant overhead for committers handling the current surge of reports - a surge which mostly comprises Low severity issues. It also delays us getting CI runs, which potentially delays the release, exactly as happened with the recent mod_auth_digest fix in 2.4.67. I'm proposing that we change the process: once we confirm a Low (and maybe Moderate) severity issue, the fix can be pushed to the public repos like any other change, with a deliberately obfuscated commit message to conceal the security impact. The ASF Security team is fine with this approach per [1], though cautions us to not keep the obscured commits public for too long before a release. Please vote: [ ] No - keep the current process [X] Yes - push Low severity issues as obfuscated public commits [X] Yes - push Low+Moderate severity issues as obfuscated public commits If you're fine with either Low or Low+Moderate vote "Yes" on both and we'll see where the majority lies? Regards, Joe [1] https://cwiki.apache.org/confluence/display/SECURITY/Working+In+Private Thanks and regards, Rainer
Re: [VOTE] commit Low/Moderate severity security issues to public repos
On 5/8/26 1:31 PM, Joe Orton wrote: Hi all, another vote - We currently track all security issues in private, pushing these to the public repos only during the preparation for a release. This adds significant overhead for committers handling the current surge of reports - a surge which mostly comprises Low severity issues. It also delays us getting CI runs, which potentially delays the release, exactly as happened with the recent mod_auth_digest fix in 2.4.67. In Tomcat we also add: "This was fixed with commit commit_id" so it can be checked by anyone but we don't change the commit messages. I'm proposing that we change the process: once we confirm a Low (and maybe Moderate) severity issue, the fix can be pushed to the public repos like any other change, with a deliberately obfuscated commit message to conceal the security impact. The ASF Security team is fine with this approach per [1], though cautions us to not keep the obscured commits public for too long before a release. Please vote: [ ] No - keep the current process [ ] Yes - push Low severity issues as obfuscated public commits [X] Yes - push Low+Moderate severity issues as obfuscated public commits My vote ;-) If you're fine with either Low or Low+Moderate vote "Yes" on both and we'll see where the majority lies? Regards, Joe [1] https://cwiki.apache.org/confluence/display/SECURITY/Working+In+Private -- Cheers Jean-Frederic
Re: [VOTE] commit Low/Moderate severity security issues to public repos
On Fri, May 08, 2026 at 12:31:31PM +0100, Joe Orton wrote: > Please vote: > > [ ] No - keep the current process > [X] Yes - push Low severity issues as obfuscated public commits > [X] Yes - push Low+Moderate severity issues as obfuscated public commits My vote, though I'm more on the fence about Moderates. Also worth saying this doesn't need to be set in stone.
Re: [VOTE] commit Low/Moderate severity security issues to public repos
On 5/8/26 1:31 PM, Joe Orton wrote: > Hi all, another vote - > > We currently track all security issues in private, pushing these to the > public repos only during the preparation for a release. This adds > significant overhead for committers handling the current surge of > reports - a surge which mostly comprises Low severity issues. It also > delays us getting CI runs, which potentially delays the release, exactly > as happened with the recent mod_auth_digest fix in 2.4.67. > > I'm proposing that we change the process: once we confirm a Low (and > maybe Moderate) severity issue, the fix can be pushed to the public > repos like any other change, with a deliberately obfuscated commit > message to conceal the security impact. The ASF Security team is fine > with this approach per [1], though cautions us to not keep the obscured > commits public for too long before a release. > > Please vote: > > [ ] No - keep the current process > [X] Yes - push Low severity issues as obfuscated public commits > [ ] Yes - push Low+Moderate severity issues as obfuscated public commits > Regards Rüdiger
Re: [VOTE] commit Low/Moderate severity security issues to public repos
On Sat, May 9, 2026 at 9:10 AM Peter wrote: > Why am I getting these emails? > > Please explain what this email is saying basically. > > How did you get my info? > > On Fri, 8 May 2026, 13:47 Steffen, wrote: > >> Please vote: >> >> >> [ ] No - keep the current process >> >> [ ] Yes - push Low severity issues as obfuscated public commits >> >> [ X] Yes - push Low+Moderate severity issues as obfuscated public commits >> >> Op 8 mei 2026 om 14:37 heeft Rainer Jung het >> volgende geschreven: >> >> Am 08.05.26 um 14:27 schrieb Steffen: >> > Sorry can you explain obfuscated. Translate to Dutch makes no sense. >> See attachment. >> >> It might be "verhullen". >> >> Meaning (as Joe already wrote) we do not mention the security impact in >> the original commit message, only the local change without too much detail. >> >> Peter, you subscribed to the [email protected] mailing list, i.e. by sending an email to [email protected]. To unsubscribe, send an email to [email protected].
Re: [VOTE] commit Low/Moderate severity security issues to public repos
Why am I getting these emails? Please explain what this email is saying basically. How did you get my info? On Fri, 8 May 2026, 13:47 Steffen, wrote: > Please vote: > > > [ ] No - keep the current process > > [ ] Yes - push Low severity issues as obfuscated public commits > > [ X] Yes - push Low+Moderate severity issues as obfuscated public commits > > Op 8 mei 2026 om 14:37 heeft Rainer Jung het > volgende geschreven: > > Am 08.05.26 um 14:27 schrieb Steffen: > > Sorry can you explain obfuscated. Translate to Dutch makes no sense. See > attachment. > > It might be "verhullen". > > Meaning (as Joe already wrote) we do not mention the security impact in > the original commit message, only the local change without too much detail. > >
Re: [VOTE] commit Low/Moderate severity security issues to public repos
Please vote: [ ] No - keep the current process [ ] Yes - push Low severity issues as obfuscated public commits [ X] Yes - push Low+Moderate severity issues as obfuscated public commits > Op 8 mei 2026 om 14:37 heeft Rainer Jung het > volgende geschreven: > Am 08.05.26 um 14:27 schrieb Steffen: > > Sorry can you explain obfuscated. Translate to Dutch makes no sense. See > > attachment. > > It might be "verhullen". > > Meaning (as Joe already wrote) we do not mention the security impact in the > original commit message, only the local change without too much detail.
Re: [VOTE] commit Low/Moderate severity security issues to public repos
Am 08.05.26 um 14:27 schrieb Steffen: > Sorry can you explain obfuscated. Translate to Dutch makes no sense. See attachment. It might be "verhullen". Meaning (as Joe already wrote) we do not mention the security impact in the original commit message, only the local change without too much detail.
Re: [VOTE] commit Low/Moderate severity security issues to public repos
On Fri, May 8, 2026 at 7:31 AM Joe Orton wrote: > > Hi all, another vote - > > We currently track all security issues in private, pushing these to the > public repos only during the preparation for a release. This adds > significant overhead for committers handling the current surge of > reports - a surge which mostly comprises Low severity issues. It also > delays us getting CI runs, which potentially delays the release, exactly > as happened with the recent mod_auth_digest fix in 2.4.67. > > I'm proposing that we change the process: once we confirm a Low (and > maybe Moderate) severity issue, the fix can be pushed to the public > repos like any other change, with a deliberately obfuscated commit > message to conceal the security impact. The ASF Security team is fine > with this approach per [1], though cautions us to not keep the obscured > commits public for too long before a release. > > Please vote: > > [ ] No - keep the current process > [x] Yes - push Low severity issues as obfuscated public commits > [x] Yes - push Low+Moderate severity issues as obfuscated public commits I am assuming we'd still do most of the same private tracking for these (and add a way to save the 2.4.x revision).
