potiuk opened a new pull request, #2186: URL: https://github.com/apache/activemq/pull/2186
**This is a proposal for the ActiveMQ PMC to review — please correct, reject, or discuss as needed.** Nothing here is a requirement; the maintainers are the decision-makers and the PMC owns the document. This adds a draft `THREAT_MODEL.md` for apache/activemq (Classic) and wires `AGENTS.md -> SECURITY.md -> THREAT_MODEL.md` so an automated security scanner can mechanically discover the model. This is the "jump start" the PMC asked us to bootstrap — a concrete starting point to react to rather than a blank form. The draft was generated from ActiveMQ's own public artefacts (`SECURITY.md`, the security docs, advisory history) using the [`threat-model-producer`](https://gist.github.com/scovetta/2dc9a0695c7cbcc32e23799e00d2ced3) rubric. Every claim carries a provenance tag: - *(documented)* — lifted from an ActiveMQ doc; cited inline. - *(inferred)* — our guess from architecture / domain norms. **Every *(inferred)* tag has a matching numbered question in §14 "Open questions for the maintainers"** to confirm, correct, or strike. What's most useful from the PMC: walk the §14 questions (10 of them) and answer in-thread / on the PR — a one-line confirm / correct / strike each is enough. We fold the answers in and the *(inferred)* tags become *(maintainer)*. Please sanity-check these especially: - §8 — the deserialization RCE guarantees (`SERIALIZABLE_PACKAGES` allow-list; OpenWire unmarshalling); - §9 — the "default distribution is not secure until configured" stance and the false-friends (JMS selectors, `ClientId`, `BlobMessage` URIs); - §11a — the known-non-findings list that suppresses recurring scanner noise. Context: the ASF Security team is preparing projects for an automated agentic security scan we're piloting; discoverability (the `AGENTS.md` chain) is the one hard prerequisite — everything else is suggestion. This PR is the public-repo piece; program details are on the PMC's private list. This PR does not edit any existing content — it only adds the model + the discoverability wiring. Questions / pushback welcome. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected] For further information, visit: https://activemq.apache.org/contact
