This is an automated email from the ASF dual-hosted git repository.
lprimak pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/shiro-site.git
The following commit(s) were added to refs/heads/main by this push:
new 0b54f9ce8 enh: Fall CNCF security slam
0b54f9ce8 is described below
commit 0b54f9ce81d6c07a7c7cba714cb7e3225f162792
Author: lprimak <[email protected]>
AuthorDate: Mon Nov 9 21:07:40 2026 -0600
enh: Fall CNCF security slam
---
src/site/content/documentation.adoc | 1 +
src/site/content/download.adoc | 9 ++++
src/site/content/external-interfaces.adoc | 72 +++++++++++++++++++++++++++++++
src/site/content/security-reports.adoc | 12 ++++++
src/site/content/support.adoc | 28 ++++++++++++
src/site/content/team.adoc | 52 ++++++++++++++++++++--
6 files changed, 171 insertions(+), 3 deletions(-)
diff --git a/src/site/content/documentation.adoc
b/src/site/content/documentation.adoc
index eb65327be..5d4c27d2c 100644
--- a/src/site/content/documentation.adoc
+++ b/src/site/content/documentation.adoc
@@ -27,6 +27,7 @@ Once you understand the basics, explore the
link:guides.html[Guides] page for a
=== Reference Manual
* link:reference.html[Reference Manual] - comprehensive reference covering all
Shiro concepts and features
+* link:external-interfaces.html[External Interfaces] - Java API,
configuration, web and command line interfaces
=== Guides - important Shiro concepts:
diff --git a/src/site/content/download.adoc b/src/site/content/download.adoc
index 168516e4f..b7a0ee991 100644
--- a/src/site/content/download.adoc
+++ b/src/site/content/download.adoc
@@ -20,3 +20,12 @@ You may
link:https://infra.apache.org/release-signing.html#verifying-signature[v
The current release is ${versions.latestRelease}.
For older releases, please visit our link:release-archive.html[release
archive].
+
+== Release process
+
+Releases are built, signed and published by a committer acting as release
manager, following the https://www.apache.org/legal/release-policy.html[ASF
release policy] and the project's link:performing-a-release.html[Performing a
Release] guide.
+A release candidate is staged, voted on by the PMC on the `dev` mailing list,
and only then published as the official source release, with binary artifacts
on Maven Central.
+Each release is signed with the release manager's PGP key and accompanied by a
SHA-512 checksum.
+To verify a download, import the
link:https://downloads.apache.org/shiro/KEYS[KEYS] file, check the `.asc`
signature and compare the checksum, as described in the
https://www.apache.org/info/verification.html[ASF verification guide].
+Release notes are published with each release on
https://github.com/apache/shiro/releases[GitHub Releases] and on the project
blog.
+Which release lines are supported is described on the
link:support.html#supported-versions[support page].
diff --git a/src/site/content/external-interfaces.adoc
b/src/site/content/external-interfaces.adoc
new file mode 100644
index 000000000..370c3e87b
--- /dev/null
+++ b/src/site/content/external-interfaces.adoc
@@ -0,0 +1,72 @@
+= Apache Shiro External Interfaces
+:jbake-date: 2026-11-09 00:00:00
+:jbake-type: page
+:jbake-status: published
+:jbake-tags: documentation, api, interfaces, configuration, security
+:jbake-description: The external software interfaces of Apache Shiro: the Java
API, configuration formats, web and framework integration points, and the
command line tools.
+:idprefix:
+:icons: font
+:toc:
+
+This page describes every external software interface of the released Apache
Shiro artifacts, and points to the detailed documentation for each.
+Shiro is a library embedded in an application; it does not open network ports
or run as a service of its own.
+
+== Java API
+
+The public Java API is the primary interface.
+Types and packages in the released artifacts are documented in the
https://shiro.apache.org/static/current/apidocs/[API documentation] (also
available at https://javadoc.io/doc/org.apache.shiro[javadoc.io]).
+The main entry points are:
+
+[cols="1,3",options="header"]
+|===
+| Interface | Purpose
+
+| `org.apache.shiro.SecurityUtils`, `Subject`
+| Obtain the current user and perform authentication, authorization and
session operations.
+See link:architecture.html[Architecture] and
link:authentication.html[Authentication].
+
+| `SecurityManager`, `Realm`, `AuthenticationStrategy`, `CredentialsMatcher`
+| Extension points for credential verification and data sources.
+See link:realm.html[Realms].
+
+| `Authorizer`, permissions, annotations (`@RequiresAuthentication`,
`@RequiresPermissions`, `@RequiresRoles`)
+| Authorization checks. See link:authorization.html[Authorization].
+
+| `SessionManager`, `SessionDAO`
+| Session management and persistence. See link:session-management.html[Session
Management].
+
+| `CipherService`, `Hash`, `HashService`, `PasswordService`
+| Cryptography. See link:cryptography.html[Cryptography].
+
+| `CacheManager`
+| Caching of authentication and authorization data. See
link:caching.html[Caching].
+|===
+
+== Configuration interfaces
+
+Configuration is supplied by the application's operator and is trusted input.
+See link:configuration.html[Configuration] for the full reference.
+
+* The INI format (`shiro.ini`), including the `[main]`, `[users]`, `[roles]`
and `[urls]` sections.
+* Programmatic configuration through the Java API, and Spring, Spring Boot,
Guice, CDI and Jakarta EE configuration.
+* Java system properties and environment settings documented for individual
features.
+
+== Web interfaces
+
+The web modules integrate through standard Jakarta Servlet mechanisms.
+They consume HTTP requests (path, headers, cookies, form parameters) from
untrusted clients, apply the configured filter chains and cookie handling, and
produce redirects and responses.
+See link:web.html[Web Support], link:web-features.html[Web Features],
link:jakarta-ee.html[Jakarta EE] and the link:security-model.html[security
model] for the trust assumptions that apply.
+
+== Framework integrations
+
+Optional modules integrate Shiro with Spring, Spring Boot, Guice, CDI, EJB,
JAX-RS, AspectJ, Quartz and JCache.
+Each integration is documented on its own page linked from the
link:documentation.html[documentation hub] and in the
link:reference.html[reference manual].
+
+== Command line tools
+
+The command line hasher (`shiro-tools-hasher`) hashes passwords and data from
the command line.
+See link:command-line-hasher.html[Command Line Hasher].
+
+== Compatibility
+
+Supported release lines are listed on the
link:support.html#supported-versions[support page].
diff --git a/src/site/content/security-reports.adoc
b/src/site/content/security-reports.adoc
index 5a53488a7..c5f537ea6 100644
--- a/src/site/content/security-reports.adoc
+++ b/src/site/content/security-reports.adoc
@@ -26,6 +26,18 @@ An overview of the vulnerability handling process is:
* A new release of the Apache Shiro concerned is made that includes the fix.
* The vulnerability is publicly announced.
+=== Response timeframe
+
+The security team acknowledges every report sent to
link:mailto:[email protected][[email protected]] within *14
days*.
+After acknowledging, the PMC keeps the reporter informed of progress while it
confirms the issue, develops and tests a fix, and prepares a release.
+The reporter is credited in the published advisory unless they ask not to be.
+Please do not disclose the vulnerability publicly until the fix is released
and the advisory is published.
+Reports are triaged against the link:security-model.html[security model],
which lists what is and is not considered a vulnerability.
+
+Fixed vulnerabilities are published on this page, with affected versions,
mitigations and CVE identifiers.
+Only the most recent release line receives all security fixes; see
link:support.html#supported-versions[Supported versions].
+Fixes for older release lines that are out of scope for the open source
project are available through link:commercial-support.html[commercial support].
+
A https://www.apache.org/security/committers.html[more detailed description of
the process] has been written for committers. Reporters of security
vulnerabilities may also find it useful.
== Apache Shiro Vulnerability Reports
diff --git a/src/site/content/support.adoc b/src/site/content/support.adoc
index f400cec4c..5c4793045 100644
--- a/src/site/content/support.adoc
+++ b/src/site/content/support.adoc
@@ -16,6 +16,34 @@ We encourage everyone to participate and use the available
community support too
* link:issues.html[Issues and Bug Tracking]
* link:commercial-support.html[Commercial Support]
+== Scope of support
+
+Community support is provided on a best-effort basis by volunteers through the
link:mailing-lists.html[mailing lists] and
https://github.com/apache/shiro/discussions[GitHub Discussions].
+Commercial support is offered by third parties such as Flow Logix and Yupiik,
see link:commercial-support.html[Commercial Support].
+Defects are tracked in https://github.com/apache/shiro/issues[GitHub Issues],
and security vulnerabilities are reported privately as described on the
link:security-reports.html[Security Reports] page.
+
+[#supported-versions]
+== Supported versions
+
+[cols="1,3",options="header"]
+|===
+| Release line | Support
+
+| 3.x
+| Supported. Receives security fixes.
+
+| 2.x
+| Receives only critical security fixes.
+
+| 1.x
+| End of life. No further releases or security fixes.
+|===
+
+Please use the most recent release of a supported line.
+Fixes for older release lines that are out of scope for the open source
project are available through link:commercial-support.html[commercial support].
+When a release line stops receiving security fixes, the end of support is
announced on the link:mailing-lists.html[mailing lists] and on the
link:download.html[download page], and this table is updated.
+Older releases remain available in the link:release-archive.html[release
archive].
+
== Sponsorship
Sponsorship can be used simply as a way to say thank you for the work that has
been done
diff --git a/src/site/content/team.adoc b/src/site/content/team.adoc
index 39ba7a088..1e75559b0 100644
--- a/src/site/content/team.adoc
+++ b/src/site/content/team.adoc
@@ -1,8 +1,54 @@
= Apache Shiro Team
-:jbake-type: lend_a_hand
+:jbake-date: 2026-11-09 00:00:00
+:jbake-type: page
:jbake-status: published
-:jbake-tags: documentation, todo, lend-a-hand
+:jbake-tags: team, governance, roles, committers, pmc
+:jbake-description: Apache Shiro project members, roles and responsibilities,
and how project governance works at the Apache Software Foundation.
:idprefix:
:icons: font
-TODO
\ No newline at end of file
+Apache Shiro is a top-level project of the https://www.apache.org/[Apache
Software Foundation] (ASF) and is governed under the
https://www.apache.org/foundation/governance/[ASF governance model].
+
+== Project members
+
+The current members of the project, including the committers and the Project
Management Committee (PMC), are listed by the ASF:
+
+* https://projects.apache.org/committee.html?shiro[Apache Shiro PMC and
committers]
+* https://people.apache.org/committers-by-project.html#shiro[Committers by
project]
+
+Only committers have write access to the source repository and other sensitive
project resources (release signing, the website, the security mailing list).
+The PMC members additionally vote on releases and on adding new committers and
PMC members.
+
+== Roles and responsibilities
+
+[cols="1,3",options="header"]
+|===
+| Role | Responsibilities
+
+| User
+| Uses Shiro. Asks questions and gives feedback on the
link:mailing-lists.html[mailing lists] and in
https://github.com/apache/shiro/discussions[GitHub Discussions].
+
+| Contributor
+| Reports defects and submits pull requests, following the
https://github.com/apache/shiro/blob/main/CONTRIBUTING.md[contributing guide].
Contributors either have an https://www.apache.org/licenses/icla.pdf[ICLA] on
file with the ASF or tick the license acknowledgment checkbox in the pull
request template.
+
+| Committer
+| Has write access. Reviews and merges contributions, triages issues, takes
part in discussions, and may act as release manager.
+
+| PMC member
+| A committer who also takes part in project governance: votes on releases,
new committers and PMC members, handles private reports sent to the security
team, and is responsible to the ASF board for the health of the project.
+
+| PMC chair
+| Officer of the ASF who reports on the project's status to the ASF board, and
is the administrative contact for the project.
+|===
+
+== Granting access
+
+New committers are proposed by an existing committer and elected by a PMC vote.
+Before elevated access is granted, the PMC reviews the candidate's sustained,
public contributions, communication on the project's lists, and willingness to
follow the https://www.apache.org/foundation/policies/conduct.html[ASF Code of
Conduct].
+New committers must file an https://www.apache.org/licenses/icla.pdf[ICLA]
with the ASF.
+Access to sensitive resources is limited to committers and removed when a
committer becomes inactive or leaves the project.
+See also https://www.apache.org/dev/new-committers-guide.html[the ASF new
committer guide] and the
https://www.apache.org/foundation/how-it-works.html[ASF "How it works"
documentation].
+
+== Decision making
+
+Decisions are made on the public `dev` mailing list by consensus, following
the https://www.apache.org/foundation/voting.html[ASF voting process]. Releases
require a PMC vote.
