From: Peter Krempa <[email protected]> Archives (as witnessed by recent reports) hide useful information by requiring the maintainer to download the archive which may be dangerous.
Recent submissions also contained a lot of fluff inside the archives. Instruct submitters of security issues to attach files directly instead of hiding them in an archive. Signed-off-by: Peter Krempa <[email protected]> --- docs/securityprocess.rst | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/securityprocess.rst b/docs/securityprocess.rst index b9fa8d9890..d1e7fcc424 100644 --- a/docs/securityprocess.rst +++ b/docs/securityprocess.rst @@ -20,6 +20,10 @@ apply to the core project. Ensure that the "**turn on confidentiality**" checkbox is selected prior to submitting the issue, to restrict visibility to project maintainers only. +.. important:: + Only attach plain files, do not bundle files in archives without prior request + from a libvirt maintainer. + Maintainer(s) will analyse the reported disclosure and decide whether it is to be classed as a security flaw or not. If not a security flaw, the ``confidential`` tag will be removed immediately. If a security flaw, -- 2.55.0
