howto/coordinate-embargoed-releases.html - external/gitster/git-htmldocs - Git at Google

 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
  "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
 <head>
 <meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />
 <meta name="generator" content="AsciiDoc 10.2.0" />
 <title></title>
 <style type="text/css">
 /* Shared CSS for AsciiDoc xhtml11 and html5 backends */

 /* Default font. */
 body {
  font-family: Georgia,serif;
 }

 /* Title font. */
 h1, h2, h3, h4, h5, h6,
 div.title, caption.title,
 thead, p.table.header,
 #toctitle,
 #author, #revnumber, #revdate, #revremark,
 #footer {
  font-family: Arial,Helvetica,sans-serif;
 }

 body {
  margin: 1em 5% 1em 5%;
 }

 a {
  color: blue;
  text-decoration: underline;
 }
 a:visited {
  color: fuchsia;
 }

 em {
  font-style: italic;
  color: navy;
 }

 strong {
  font-weight: bold;
  color: #083194;
 }

 h1, h2, h3, h4, h5, h6 {
  color: #527bbd;
  margin-top: 1.2em;
  margin-bottom: 0.5em;
  line-height: 1.3;
 }

 h1, h2, h3 {
  border-bottom: 2px solid silver;
 }
 h2 {
  padding-top: 0.5em;
 }
 h3 {
  float: left;
 }
 h3 + * {
  clear: left;
 }
 h5 {
  font-size: 1.0em;
 }

 div.sectionbody {
  margin-left: 0;
 }

 hr {
  border: 1px solid silver;
 }

 p {
  margin-top: 0.5em;
  margin-bottom: 0.5em;
 }

 ul, ol, li > p {
  margin-top: 0;
 }
 ul > li { color: #aaa; }
 ul > li > * { color: black; }

 .monospaced, code, pre {
  font-family: "Courier New", Courier, monospace;
  font-size: inherit;
  color: navy;
  padding: 0;
  margin: 0;
 }
 pre {
  white-space: pre-wrap;
 }

 #author {
  color: #527bbd;
  font-weight: bold;
  font-size: 1.1em;
 }
 #email {
 }
 #revnumber, #revdate, #revremark {
 }

 #footer {
  font-size: small;
  border-top: 2px solid silver;
  padding-top: 0.5em;
  margin-top: 4.0em;
 }
 #footer-text {
  float: left;
  padding-bottom: 0.5em;
 }
 #footer-badges {
  float: right;
  padding-bottom: 0.5em;
 }

 #preamble {
  margin-top: 1.5em;
  margin-bottom: 1.5em;
 }
 div.imageblock, div.exampleblock, div.verseblock,
 div.quoteblock, div.literalblock, div.listingblock, div.sidebarblock,
 div.admonitionblock {
  margin-top: 1.0em;
  margin-bottom: 1.5em;
 }
 div.admonitionblock {
  margin-top: 2.0em;
  margin-bottom: 2.0em;
  margin-right: 10%;
  color: #606060;
 }

 div.content { /* Block element content. */
  padding: 0;
 }

 /* Block element titles. */
 div.title, caption.title {
  color: #527bbd;
  font-weight: bold;
  text-align: left;
  margin-top: 1.0em;
  margin-bottom: 0.5em;
 }
 div.title + * {
  margin-top: 0;
 }

 td div.title:first-child {
  margin-top: 0.0em;
 }
 div.content div.title:first-child {
  margin-top: 0.0em;
 }
 div.content + div.title {
  margin-top: 0.0em;
 }

 div.sidebarblock > div.content {
  background: #ffffee;
  border: 1px solid #dddddd;
  border-left: 4px solid #f0f0f0;
  padding: 0.5em;
 }

 div.listingblock > div.content {
  border: 1px solid #dddddd;
  border-left: 5px solid #f0f0f0;
  background: #f8f8f8;
  padding: 0.5em;
 }

 div.quoteblock, div.verseblock {
  padding-left: 1.0em;
  margin-left: 1.0em;
  margin-right: 10%;
  border-left: 5px solid #f0f0f0;
  color: #888;
 }

 div.quoteblock > div.attribution {
  padding-top: 0.5em;
  text-align: right;
 }

 div.verseblock > pre.content {
  font-family: inherit;
  font-size: inherit;
 }
 div.verseblock > div.attribution {
  padding-top: 0.75em;
  text-align: left;
 }
 /* DEPRECATED: Pre version 8.2.7 verse style literal block. */
 div.verseblock + div.attribution {
  text-align: left;
 }

 div.admonitionblock .icon {
  vertical-align: top;
  font-size: 1.1em;
  font-weight: bold;
  text-decoration: underline;
  color: #527bbd;
  padding-right: 0.5em;
 }
 div.admonitionblock td.content {
  padding-left: 0.5em;
  border-left: 3px solid #dddddd;
 }

 div.exampleblock > div.content {
  border-left: 3px solid #dddddd;
  padding-left: 0.5em;
 }

 div.imageblock div.content { padding-left: 0; }
 span.image img { border-style: none; vertical-align: text-bottom; }
 a.image:visited { color: white; }

 dl {
  margin-top: 0.8em;
  margin-bottom: 0.8em;
 }
 dt {
  margin-top: 0.5em;
  margin-bottom: 0;
  font-style: normal;
  color: navy;
 }
 dd > *:first-child {
  margin-top: 0.1em;
 }

 ul, ol {
  list-style-position: outside;
 }
 ol.arabic {
  list-style-type: decimal;
 }
 ol.loweralpha {
  list-style-type: lower-alpha;
 }
 ol.upperalpha {
  list-style-type: upper-alpha;
 }
 ol.lowerroman {
  list-style-type: lower-roman;
 }
 ol.upperroman {
  list-style-type: upper-roman;
 }

 div.compact ul, div.compact ol,
 div.compact p, div.compact p,
 div.compact div, div.compact div {
  margin-top: 0.1em;
  margin-bottom: 0.1em;
 }

 tfoot {
  font-weight: bold;
 }
 td > div.verse {
  white-space: pre;
 }

 div.hdlist {
  margin-top: 0.8em;
  margin-bottom: 0.8em;
 }
 div.hdlist tr {
  padding-bottom: 15px;
 }
 dt.hdlist1.strong, td.hdlist1.strong {
  font-weight: bold;
 }
 td.hdlist1 {
  vertical-align: top;
  font-style: normal;
  padding-right: 0.8em;
  color: navy;
 }
 td.hdlist2 {
  vertical-align: top;
 }
 div.hdlist.compact tr {
  margin: 0;
  padding-bottom: 0;
 }

 .comment {
  background: yellow;
 }

 .footnote, .footnoteref {
  font-size: 0.8em;
 }

 span.footnote, span.footnoteref {
  vertical-align: super;
 }

 #footnotes {
  margin: 20px 0 20px 0;
  padding: 7px 0 0 0;
 }

 #footnotes div.footnote {
  margin: 0 0 5px 0;
 }

 #footnotes hr {
  border: none;
  border-top: 1px solid silver;
  height: 1px;
  text-align: left;
  margin-left: 0;
  width: 20%;
  min-width: 100px;
 }

 div.colist td {
  padding-right: 0.5em;
  padding-bottom: 0.3em;
  vertical-align: top;
 }
 div.colist td img {
  margin-top: 0.3em;
 }

 @media print {
  #footer-badges { display: none; }
 }

 #toc {
  margin-bottom: 2.5em;
 }

 #toctitle {
  color: #527bbd;
  font-size: 1.1em;
  font-weight: bold;
  margin-top: 1.0em;
  margin-bottom: 0.1em;
 }

 div.toclevel0, div.toclevel1, div.toclevel2, div.toclevel3, div.toclevel4 {
  margin-top: 0;
  margin-bottom: 0;
 }
 div.toclevel2 {
  margin-left: 2em;
  font-size: 0.9em;
 }
 div.toclevel3 {
  margin-left: 4em;
  font-size: 0.9em;
 }
 div.toclevel4 {
  margin-left: 6em;
  font-size: 0.9em;
 }

 span.aqua { color: aqua; }
 span.black { color: black; }
 span.blue { color: blue; }
 span.fuchsia { color: fuchsia; }
 span.gray { color: gray; }
 span.green { color: green; }
 span.lime { color: lime; }
 span.maroon { color: maroon; }
 span.navy { color: navy; }
 span.olive { color: olive; }
 span.purple { color: purple; }
 span.red { color: red; }
 span.silver { color: silver; }
 span.teal { color: teal; }
 span.white { color: white; }
 span.yellow { color: yellow; }

 span.aqua-background { background: aqua; }
 span.black-background { background: black; }
 span.blue-background { background: blue; }
 span.fuchsia-background { background: fuchsia; }
 span.gray-background { background: gray; }
 span.green-background { background: green; }
 span.lime-background { background: lime; }
 span.maroon-background { background: maroon; }
 span.navy-background { background: navy; }
 span.olive-background { background: olive; }
 span.purple-background { background: purple; }
 span.red-background { background: red; }
 span.silver-background { background: silver; }
 span.teal-background { background: teal; }
 span.white-background { background: white; }
 span.yellow-background { background: yellow; }

 span.big { font-size: 2em; }
 span.small { font-size: 0.6em; }

 span.underline { text-decoration: underline; }
 span.overline { text-decoration: overline; }
 span.line-through { text-decoration: line-through; }

 div.unbreakable { page-break-inside: avoid; }


 /*
  * xhtml11 specific
  *
  * */

 div.tableblock {
  margin-top: 1.0em;
  margin-bottom: 1.5em;
 }
 div.tableblock > table {
  border: 3px solid #527bbd;
 }
 thead, p.table.header {
  font-weight: bold;
  color: #527bbd;
 }
 p.table {
  margin-top: 0;
 }
 /* Because the table frame attribute is overridden by CSS in most browsers. */
 div.tableblock > table[frame="void"] {
  border-style: none;
 }
 div.tableblock > table[frame="hsides"] {
  border-left-style: none;
  border-right-style: none;
 }
 div.tableblock > table[frame="vsides"] {
  border-top-style: none;
  border-bottom-style: none;
 }


 /*
  * html5 specific
  *
  * */

 table.tableblock {
  margin-top: 1.0em;
  margin-bottom: 1.5em;
 }
 thead, p.tableblock.header {
  font-weight: bold;
  color: #527bbd;
 }
 p.tableblock {
  margin-top: 0;
 }
 table.tableblock {
  border-width: 3px;
  border-spacing: 0px;
  border-style: solid;
  border-color: #527bbd;
  border-collapse: collapse;
 }
 th.tableblock, td.tableblock {
  border-width: 1px;
  padding: 4px;
  border-style: solid;
  border-color: #527bbd;
 }

 table.tableblock.frame-topbot {
  border-left-style: hidden;
  border-right-style: hidden;
 }
 table.tableblock.frame-sides {
  border-top-style: hidden;
  border-bottom-style: hidden;
 }
 table.tableblock.frame-none {
  border-style: hidden;
 }

 th.tableblock.halign-left, td.tableblock.halign-left {
  text-align: left;
 }
 th.tableblock.halign-center, td.tableblock.halign-center {
  text-align: center;
 }
 th.tableblock.halign-right, td.tableblock.halign-right {
  text-align: right;
 }

 th.tableblock.valign-top, td.tableblock.valign-top {
  vertical-align: top;
 }
 th.tableblock.valign-middle, td.tableblock.valign-middle {
  vertical-align: middle;
 }
 th.tableblock.valign-bottom, td.tableblock.valign-bottom {
  vertical-align: bottom;
 }


 /*
  * manpage specific
  *
  * */

 body.manpage h1 {
  padding-top: 0.5em;
  padding-bottom: 0.5em;
  border-top: 2px solid silver;
  border-bottom: 2px solid silver;
 }
 body.manpage h2 {
  border-style: none;
 }
 body.manpage div.sectionbody {
  margin-left: 3em;
 }

 @media print {
  body.manpage div#toc { display: none; }
 }


 </style>
 <script type="text/javascript">
 /*<![CDATA[*/
 var asciidoc = { // Namespace.

 /////////////////////////////////////////////////////////////////////
 // Table Of Contents generator
 /////////////////////////////////////////////////////////////////////

 /* Author: Mihai Bazon, September 2002
  * http://students.infoiasi.ro/~mishoo
  *
  * Table Of Content generator
  * Version: 0.4
  *
  * Feel free to use this script under the terms of the GNU General Public
  * License, as long as you do not remove or alter this notice.
  */

  /* modified by Troy D. Hanson, September 2006. License: GPL */
  /* modified by Stuart Rackham, 2006, 2009. License: GPL */

 // toclevels = 1..4.
 toc: function (toclevels) {

  function getText(el) {
  var text = "";
  for (var i = el.firstChild; i != null; i = i.nextSibling) {
  if (i.nodeType == 3 /* Node.TEXT_NODE */) // IE doesn't speak constants.
  text += i.data;
  else if (i.firstChild != null)
  text += getText(i);
  }
  return text;
  }

  function TocEntry(el, text, toclevel) {
  this.element = el;
  this.text = text;
  this.toclevel = toclevel;
  }

  function tocEntries(el, toclevels) {
  var result = new Array;
  var re = new RegExp('[hH]([1-'+(toclevels+1)+'])');
  // Function that scans the DOM tree for header elements (the DOM2
  // nodeIterator API would be a better technique but not supported by all
  // browsers).
  var iterate = function (el) {
  for (var i = el.firstChild; i != null; i = i.nextSibling) {
  if (i.nodeType == 1 /* Node.ELEMENT_NODE */) {
  var mo = re.exec(i.tagName);
  if (mo && (i.getAttribute("class") || i.getAttribute("className")) != "float") {
  result[result.length] = new TocEntry(i, getText(i), mo[1]-1);
  }
  iterate(i);
  }
  }
  }
  iterate(el);
  return result;
  }

  var toc = document.getElementById("toc");
  if (!toc) {
  return;
  }

  // Delete existing TOC entries in case we're reloading the TOC.
  var tocEntriesToRemove = [];
  var i;
  for (i = 0; i < toc.childNodes.length; i++) {
  var entry = toc.childNodes[i];
  if (entry.nodeName.toLowerCase() == 'div'
  && entry.getAttribute("class")
  && entry.getAttribute("class").match(/^toclevel/))
  tocEntriesToRemove.push(entry);
  }
  for (i = 0; i < tocEntriesToRemove.length; i++) {
  toc.removeChild(tocEntriesToRemove[i]);
  }

  // Rebuild TOC entries.
  var entries = tocEntries(document.getElementById("content"), toclevels);
  for (var i = 0; i < entries.length; ++i) {
  var entry = entries[i];
  if (entry.element.id == "")
  entry.element.id = "_toc_" + i;
  var a = document.createElement("a");
  a.href = "#" + entry.element.id;
  a.appendChild(document.createTextNode(entry.text));
  var div = document.createElement("div");
  div.appendChild(a);
  div.className = "toclevel" + entry.toclevel;
  toc.appendChild(div);
  }
  if (entries.length == 0)
  toc.parentNode.removeChild(toc);
 },


 /////////////////////////////////////////////////////////////////////
 // Footnotes generator
 /////////////////////////////////////////////////////////////////////

 /* Based on footnote generation code from:
  * http://www.brandspankingnew.net/archive/2005/07/format_footnote.html
  */

 footnotes: function () {
  // Delete existing footnote entries in case we're reloading the footnodes.
  var i;
  var noteholder = document.getElementById("footnotes");
  if (!noteholder) {
  return;
  }
  var entriesToRemove = [];
  for (i = 0; i < noteholder.childNodes.length; i++) {
  var entry = noteholder.childNodes[i];
  if (entry.nodeName.toLowerCase() == 'div' && entry.getAttribute("class") == "footnote")
  entriesToRemove.push(entry);
  }
  for (i = 0; i < entriesToRemove.length; i++) {
  noteholder.removeChild(entriesToRemove[i]);
  }

  // Rebuild footnote entries.
  var cont = document.getElementById("content");
  var spans = cont.getElementsByTagName("span");
  var refs = {};
  var n = 0;
  for (i=0; i<spans.length; i++) {
  if (spans[i].className == "footnote") {
  n++;
  var note = spans[i].getAttribute("data-note");
  if (!note) {
  // Use [\s\S] in place of . so multi-line matches work.
  // Because JavaScript has no s (dotall) regex flag.
  note = spans[i].innerHTML.match(/\s*\[([\s\S]*)]\s*/)[1];
  spans[i].innerHTML =
  "[<a id='_footnoteref_" + n + "' href='#_footnote_" + n +
  "' title='View footnote' class='footnote'>" + n + "</a>]";
  spans[i].setAttribute("data-note", note);
  }
  noteholder.innerHTML +=
  "<div class='footnote' id='_footnote_" + n + "'>" +
  "<a href='#_footnoteref_" + n + "' title='Return to text'>" +
  n + "</a>. " + note + "</div>";
  var id =spans[i].getAttribute("id");
  if (id != null) refs["#"+id] = n;
  }
  }
  if (n == 0)
  noteholder.parentNode.removeChild(noteholder);
  else {
  // Process footnoterefs.
  for (i=0; i<spans.length; i++) {
  if (spans[i].className == "footnoteref") {
  var href = spans[i].getElementsByTagName("a")[0].getAttribute("href");
  href = href.match(/#.*/)[0]; // Because IE return full URL.
  n = refs[href];
  spans[i].innerHTML =
  "[<a href='#_footnote_" + n +
  "' title='View footnote' class='footnote'>" + n + "</a>]";
  }
  }
  }
 },

 install: function(toclevels) {
  var timerId;

  function reinstall() {
  asciidoc.footnotes();
  if (toclevels) {
  asciidoc.toc(toclevels);
  }
  }

  function reinstallAndRemoveTimer() {
  clearInterval(timerId);
  reinstall();
  }

  timerId = setInterval(reinstall, 500);
  if (document.addEventListener)
  document.addEventListener("DOMContentLoaded", reinstallAndRemoveTimer, false);
  else
  window.onload = reinstallAndRemoveTimer;
 }

 }
 asciidoc.install();
 /*]]>*/
 </script>
 </head>
 <body class="article">
 <div id="header">
 </div>
 <div id="content">
 <div class="sect1">
 <h2 id="_how_we_coordinate_embargoed_releases">How we coordinate embargoed releases</h2>
 <div class="sectionbody">
 <div class="paragraph"><p>To protect Git users from critical vulnerabilities, we do not just release
 fixed versions like regular maintenance releases. Instead, we coordinate
 releases with packagers, keeping the fixes under an embargo until the release
 date. That way, users will have a chance to upgrade on that date, no matter
 what Operating System or distribution they run.</p></div>
 </div>
 </div>
 <div class="sect1">
 <h2 id="_the_code_git_security_code_mailing_list">The <code>git-security</code> mailing list</h2>
 <div class="sectionbody">
 <div class="paragraph"><p>Responsible disclosures of vulnerabilities, analysis, proposed fixes as
 well as the orchestration of coordinated embargoed releases all happen on the
 <code>git-security</code> mailing list at &lt;<a href="mailto:git-security@googlegroups.com">git-security@googlegroups.com</a>&gt;.</p></div>
 <div class="paragraph"><p>In this context, the term "embargo" refers to the time period that information
 about a vulnerability is kept under wraps and only shared on a need-to-know
 basis. This is necessary to protect Git&#8217;s users from bad actors who would
 otherwise be made aware of attack vectors that could be exploited. "Lifting the
 embargo" refers to publishing the version that fixes the vulnerabilities.</p></div>
 <div class="sect2">
 <h3 id="_audience_of_the_code_git_security_code_mailing_list">Audience of the <code>git-security</code> mailing list</h3>
 <div class="paragraph"><p>Anybody may contact the <code>git-security</code> mailing list by sending an email
 to &lt;<a href="mailto:git-security@googlegroups.com">git-security@googlegroups.com</a>&gt;, though the archive is closed to the
 public and only accessible to subscribed members.</p></div>
 <div class="paragraph"><p>There are a few dozen subscribed members: core Git developers who are trusted
 with addressing vulnerabilities, and stakeholders (i.e. owners of products
 affected by security vulnerabilities in Git).</p></div>
 <div class="paragraph"><p>Most of the discussions revolve around assessing the severity of the reported
 issue (including the decision whether the report is security-relevant or can be
 redirected to the public mailing list), how to remediate the issue, determining
 the timeline of the disclosure as well as aligning priorities and
 requirements.</p></div>
 </div>
 <div class="sect2">
 <h3 id="_communications">Communications</h3>
 <div class="paragraph"><p>If you are a stakeholder, it is a good idea to pay close attention to the
 discussions, as pertinent information may be buried in the middle of a lively
 conversation that might not look relevant to your interests. For example, the
 tentative timeline might be agreed upon in the middle of discussing code
 comment formatting in one of the patches and whether or not to combine fixes
 for multiple, separate vulnerabilities into the same embargoed release. Most
 mail threads are not usually structured specifically to communicate
 agreements, assessments or timelines.</p></div>
 </div>
 </div>
 </div>
 <div class="sect1">
 <h2 id="_typical_timeline">Typical timeline</h2>
 <div class="sectionbody">
 <div class="ulist"><ul>
 <li>
 <p>
 A potential vulnerability is reported to the <code>git-security</code> mailing list.
 </p>
 </li>
 <li>
 <p>
 The members of the git-security list start a discussion to give an initial
  assessment of the severity of the reported potential vulnerability.
  We aspire to do so within a few days.
 </p>
 </li>
 <li>
 <p>
 After discussion, if consensus is reached that it is not critical enough
  to warrant any embargo, the reporter is redirected to the public Git mailing
  list. This ends the reporter&#8217;s interaction with the <code>git-security</code> list.
 </p>
 </li>
 <li>
 <p>
 If it is deemed critical enough for an embargo, ideas are presented on how to
  address the vulnerability.
 </p>
 </li>
 <li>
 <p>
 Usually around that time, the Git maintainer or their delegate(s) open a draft
  security advisory in the <code>git/git</code> repository on GitHub (see below for more
  details).
 </p>
 </li>
 <li>
 <p>
 Code review can take place in a variety of different locations,
  depending on context. These are: patches sent inline on the git-security list,
  a private fork on GitHub associated with the draft security advisory, or the
  git/cabal repository.
 </p>
 </li>
 <li>
 <p>
 Contributors working on a fix should consider beginning by sending
  patches to the git-security list (inline with the original thread), since they
  are accessible to all subscribers, along with the original reporter.
 </p>
 </li>
 <li>
 <p>
 Once the review has settled and everyone involved in the review agrees that
  the patches are nearing the finish line, the Git maintainer, and others
  determine a release date as well as the release trains that are serviced. The
  decision regarding which versions need a backported fix is based on input from
  the reporter, the contributor who worked on the patches, and from
  stakeholders. Operators of hosting sites who may want to analyze whether the
  given issue is exploited via any of the repositories they host, and binary
  packagers who want to make sure their product gets patched adequately against
  the vulnerability, for example, may want to give their input at this stage.
 </p>
 </li>
 <li>
 <p>
 While the Git community does its best to accommodate the specific timeline
  requests of the various binary packagers, the nature of the issue may preclude
  a prolonged release schedule. For fixes deemed urgent, it may be in the best
  interest of the Git users community to shorten the disclosure and release
  timeline, and packagers may need to adapt accordingly.
 </p>
 </li>
 <li>
 <p>
 Subsequently, branches with the fixes are pushed to the git/cabal repository.
 </p>
 </li>
 <li>
 <p>
 The tags are created by the Git maintainer and pushed to the same repository.
 </p>
 </li>
 <li>
 <p>
 The Git for Windows, Git for macOS, BSD, Debian, etc. maintainers prepare the
  corresponding release artifacts, based on the tags created that have been
  prepared by the Git maintainer.
 </p>
 </li>
 <li>
 <p>
 The release artifacts prepared by various binary packagers can be
  made available to stakeholders under embargo via a mail to the
  <code>git-security</code> list.
 </p>
 </li>
 <li>
 <p>
 Less than a week before the release, a mail with the relevant information is
  sent to &lt;<a href="mailto:distros@vs.openwall.org">distros@vs.openwall.org</a>&gt; (see below), a list used to pre-announce
  embargoed releases of open source projects to the stakeholders of all major
  distributions of Linux as well as other OSes.
 </p>
 </li>
 <li>
 <p>
 Public communication is then prepared in advance of the release date. This
  includes blog posts and mails to the Git and Git for Windows mailing lists.
 </p>
 </li>
 <li>
 <p>
 On the day of the release, at around 10am Pacific Time, the Git maintainer
  pushes the tag and the <code>master</code> branch to the public repository, then sends
  out an announcement mail.
 </p>
 </li>
 <li>
 <p>
 Once the tag is pushed, the Git for Windows maintainer publishes the
  corresponding tag and creates a GitHub Release with the associated release
  artifacts (Git for Windows installer, Portable Git, MinGit, etc).
 </p>
 </li>
 <li>
 <p>
 Git for Windows release is then announced via a mail to the public Git and
  Git for Windows mailing lists as well as via a tweet.
 </p>
 </li>
 <li>
 <p>
 Ditto for distribution packagers for Linux and other platforms:
  their releases are announced via their preferred channels.
 </p>
 </li>
 <li>
 <p>
 A mail to &lt;<a href="mailto:oss-security@lists.openwall.org">oss-security@lists.openwall.org</a>&gt; (see below for details) is sent
  as a follow-up to the &lt;<a href="mailto:distros@vs.openwall.org">distros@vs.openwall.org</a>&gt; one, describing the
  vulnerability in detail, often including a proof of concept of an exploit.
 </p>
 </li>
 </ul></div>
 <div class="paragraph"><p>Note: The Git project makes no guarantees about timelines, but aims to keep
 embargoes reasonably short in the interest of keeping Git&#8217;s users safe.</p></div>
 <div class="sect2">
 <h3 id="_opening_a_security_advisory_draft">Opening a Security Advisory draft</h3>
 <div class="paragraph"><p>The first step is to <a href="https://github.com/git/git/security/advisories/new">open
 an advisory</a>. Technically, this is not necessary. However, it is the most
 convenient way to obtain the CVE number and it gives us a private repository
 associated with it that can be used to collaborate on a fix.</p></div>
 </div>
 <div class="sect2">
 <h3 id="_notifying_the_linux_distributions">Notifying the Linux distributions</h3>
 <div class="paragraph"><p>At most two weeks before release date, we need to send a notification to
 &lt;<a href="mailto:distros@vs.openwall.org">distros@vs.openwall.org</a>&gt;, preferably less than 7 days before the release date.
 This will reach most (all?) Linux distributions. See an example below, and the
 guidelines for this mailing list at
 <a href="https://oss-security.openwall.org/wiki/mailing-lists/distros#how-to-use-the-lists">here</a>.</p></div>
 <div class="paragraph"><p>Once the version has been published, we send a note about that to oss-security.
 As an example, see <a href="https://www.openwall.com/lists/oss-security/2019/12/13/1">the
 v2.24.1 mail</a>;
 <a href="https://oss-security.openwall.org/wiki/mailing-lists/oss-security">Here</a> are
 their guidelines.</p></div>
 <div class="paragraph"><p>The mail to oss-security should also describe the exploit, and give credit to
 the reporter(s): security researchers still receive too little respect for the
 invaluable service they provide, and public credit goes a long way to keep them
 paid by their respective organizations.</p></div>
 <div class="paragraph"><p>Technically, describing any exploit can be delayed up to 7 days, but we usually
 refrain from doing that, including it right away.</p></div>
 <div class="paragraph"><p>As a courtesy we typically attach a Git bundle (as <code>.tar.xz</code> because the list
 will drop <code>.bundle</code> attachments) in the mail to distros@ so that the involved
 parties can take care of integrating/backporting them. This bundle is typically
 created using a command like this:</p></div>
 <div class="literalblock">
 <div class="content">
 <pre><code>git bundle create cve-xxx.bundle ^origin/master vA.B.C vD.E.F
 tar cJvf cve-xxx.bundle.tar.xz cve-xxx.bundle</code></pre>
 </div></div>
 </div>
 <div class="sect2">
 <h3 id="_example_mail_to_a_href_mailto_distros_vs_openwall_org_distros_vs_openwall_org_a">Example mail to <a href="mailto:distros@vs.openwall.org">distros@vs.openwall.org</a></h3>
 <div class="literalblock">
 <div class="content">
 <pre><code>To: distros@vs.openwall.org
 Cc: git-security@googlegroups.com, &lt;other people involved in the report/fix&gt;
 Subject: [vs] Upcoming Git security fix release

 Team,

 The Git project will release new versions on &lt;date&gt; at 10am Pacific Time or
 soon thereafter. I have attached a Git bundle (embedded in a `.tar.xz` to avoid
 it being dropped) which you can fetch into a clone of
 https://github.com/git/git via `git fetch --tags /path/to/cve-xxx.bundle`,
 containing the tags for versions &lt;versions&gt;.

 You can verify with `git tag -v &lt;tag&gt;` that the versions were signed by
 the Git maintainer, using the same GPG key as e.g. v2.24.0.

 Please use these tags to prepare `git` packages for your various
 distributions, using the appropriate tagged versions. The added test cases
 help verify the correctness.

 The addressed issues are:

 &lt;list of CVEs with a short description, typically copy/pasted from Git's
 release notes, usually demo exploit(s), too&gt;

 Credit for finding the vulnerability goes to &lt;reporter&gt;, credit for fixing
 it goes to &lt;developer&gt;.

 Thanks,
 &lt;name&gt;</code></pre>
 </div></div>
 </div>
 <div class="sect2">
 <h3 id="_example_mail_to_a_href_mailto_oss_security_lists_openwall_com_oss_security_lists_openwall_com_a">Example mail to <a href="mailto:oss-security@lists.openwall.com">oss-security@lists.openwall.com</a></h3>
 <div class="literalblock">
 <div class="content">
 <pre><code>To: oss-security@lists.openwall.com
 Cc: git-security@googlegroups.com, &lt;other people involved in the report/fix&gt;
 Subject: git: &lt;copy from security advisory&gt;

 Team,

 The Git project released new versions on &lt;date&gt;, addressing &lt;CVE&gt;.

 All supported platforms are affected in one way or another, and all Git
 versions all the way back to &lt;version&gt; are affected. The fixed versions are:
 &lt;versions&gt;.

 Link to the announcement: &lt;link to lore.kernel.org/git&gt;

 We highly recommend to upgrade.

 The addressed issues are:
 * &lt;list of CVEs and their explanations, along with demo exploits&gt;

 Credit for finding the vulnerability goes to &lt;reporter&gt;, credit for fixing
 it goes to &lt;developer&gt;.

 Thanks,
 &lt;name&gt;</code></pre>
 </div></div>
 </div>
 </div>
 </div>
 </div>
 <div id="footnotes"><hr /></div>
 <div id="footer">
 <div id="footer-text">
 Last updated
  2024-02-06 15:01:54 PST
 </div>
 </div>
 </body>
 </html>