This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 7aae27315946 chore: add project-security.md to the OSS helper rules
(#28081)
7aae27315946 is described below
commit 7aae273159462fba6e7ab3ea2aca594eaa03d787
Author: Andrea Cosentino <[email protected]>
AuthorDate: Mon Oct 19 09:39:01 2026 +0200
chore: add project-security.md to the OSS helper rules (#28081)
The OSS Helper security commands read an optional project-security.md
for the reporting channel, the CNA, the advisory format and location,
the supported release lines and the disclosure steps. When the Camel
rules moved into .oss-ai-helper-rules/, only the three required files
came along, and project-local rules take precedence over installed
ones, so the helper cannot see Camel's security settings.
Add the file, based on the earlier known-projects version, updated:
supported branches camel-4.22.x and camel-4.18.x (4.14.x is end of
life), the public fix model, the security model, how fixed versions are
derived, and how the CVE record gets published.
Signed-off-by: Andrea Cosentino <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>
---
.oss-ai-helper-rules/project-security.md | 37 ++++++++++++++++++++++++++++++++
1 file changed, 37 insertions(+)
diff --git a/.oss-ai-helper-rules/project-security.md
b/.oss-ai-helper-rules/project-security.md
new file mode 100644
index 000000000000..75520b8b23b8
--- /dev/null
+++ b/.oss-ai-helper-rules/project-security.md
@@ -0,0 +1,37 @@
+# Project Security
+
+This rule file contains the security and CVE-handling workflow for the
project: how a vulnerability is reported, triaged, fixed, assigned a CVE, and
published. Commands read this file to determine the private reporting channel,
the CVE Numbering Authority (CNA), the advisory format and publication
location, and the supported release lines a fix must be backported to.
+
+This file is **optional**. Commands that do not deal with security ignore it.
The security commands (`/oss-triage-security-report`,
`/oss-create-security-advisory`, `/oss-draft-cve`,
`/oss-analyze-third-party-cve`) read it when present, and fall back to asking
the maintainer when it is absent.
+
+- **Private reporting channel:** `[email protected]`, the ASF Security Team,
as described at https://camel.apache.org/security/ and
https://www.apache.org/security/. Apache Camel does not operate a dedicated
`[email protected]` list. Never use Jira, GitHub issues or PRs, or any
public mailing list to report an undisclosed vulnerability.
+- **GitHub private vulnerability reporting:** not used. Coordination happens
on `[email protected]`, not through GitHub Security Advisories, so
`/oss-create-security-advisory` should direct reporters to
`[email protected]` rather than to the GitHub `/reports` endpoint.
+- **Undisclosed fix model:** `public`. An undisclosed vulnerability is fixed
in the open, through a Jira issue and a pull request whose text describes the
change in functional terms only: no security wording, no CVE identifier, no
reporter identity, no exploit details. The fix is backported to every supported
maintenance branch, and the advisory is published after the fixed releases are
out.
+- **Security model:** triage reports against
`docs/user-manual/modules/ROOT/pages/security-model.adoc`. It defines who is
trusted, where the trust boundaries sit, and which vulnerability classes are in
or out of scope.
+- **CVE Numbering Authority (CNA):** the Apache Software Foundation Security
Team, the only body that can allocate CVE IDs for ASF projects. The PMC
reserves an ID through https://cveprocess.apache.org (or by emailing
`[email protected]` with the subject `CVE request for ...`). The portal also
holds the CVE record and offers a REVIEW state for Security Team sign-off. The
OSS Helper never reserves, requests, or generates CVE IDs; it only drafts
against an already-reserved ID.
+- **Severity:** the advisory's `Severity` field is a qualitative rating (Low,
Medium, High, Critical). Camel advisory pages do not publish a CVSS score or
vector string; compute a CVSS vector only for the CVE record.
+- **Advisory source format:** a Hugo Markdown page named `CVE-YYYY-NNNNN.md`,
plus a PGP-clearsigned plaintext `CVE-YYYY-NNNNN.txt.asc` linked from the
advisory's `References` section. `/oss-draft-cve` emits the `.md` page and the
matching `.txt` body; a PMC member signs the `.txt` into `.txt.asc` after
review.
+- **Advisory section structure (exact labels, in order):** `Severity`,
`Summary`, `Versions affected`, `Versions fixed`, `Description`, `Notes`,
`Mitigation`, `Credit`, `References`.
+- **Advisory template (reference):** the source of any recent advisory under
`content/security/` in https://github.com/apache/camel-website, for example
https://github.com/apache/camel-website/blob/main/content/security/CVE-2025-27636.md
(rendered at https://camel.apache.org/security/CVE-2025-27636.html). Pass it
as the `/oss-draft-cve template=` argument so that the draft matches the
current house style.
+- **Publication location:** `apache/camel-website`, under `content/security/`
(`CVE-YYYY-NNNNN.md` and `CVE-YYYY-NNNNN.txt.asc`). The advisory renders at
`https://camel.apache.org/security/CVE-YYYY-NNNNN.html`.
+- **Signing key:** a PMC member's GPG key published in
https://downloads.apache.org/camel/KEYS. `gpg --clearsign CVE-YYYY-NNNNN.txt`
produces `CVE-YYYY-NNNNN.txt.asc`. The OSS Helper never runs `gpg`; the
maintainer signs after review.
+- **Supported maintenance branches:** `camel-4.22.x` and `camel-4.18.x`, the
LTS lines as of October 2026 (each LTS line receives about a year of CVE and
critical bug fixes; see https://camel.apache.org/categories/Roadmap/ for the
current status). Backport every security fix to each of them. Upgrade-guide
notes for every line go on `main`, as `project-guidelines.md` describes.
+- **End-of-life branches (no backports):** `camel-4.14.x`, `camel-4.10.x` and
every older `camel-4.x` and `camel-3.x` branch. These branches still exist and
build, but that is not evidence that they are supported.
+- **Fixed versions:** derive them with `git tag --contains <fix-commit> | sort
-V`; the smallest tag per line is that line's fixed version. A patch release is
cut from a `release/<version>` branch before the maintenance branch's version
is bumped, so a fix merged after the cut ships in the next patch: check the
tags, not the pom version. A tag is not a release until the artifacts are on
Maven Central.
+- **Disclosure & announcement:** publish only after the fixed releases are
available. Announce to `[email protected]` and `[email protected]`,
notify the reporter, and post to `[email protected]`. The ASF
Security Team submits the CVE record to the CVE Program once the record
references the published advisory. The `oss-security` post is the first public
mention of the issue; never disclose specifics before the fix is released.
+- **Third-party CVE notes ("not affected" rationale):** where
`/oss-analyze-third-party-cve` should record a verified exposure analysis.
(TODO: Camel has no standard public location for "not affected" notes yet;
decide whether to track them in release notes, a dedicated security page, or a
private PMC tracking issue.)
+
+## CVE Handling Workflow
+
+The end-to-end process. The OSS Helper command that assists each step is in
brackets; steps marked *(manual)* are maintainer or PMC actions with no command.
+
+1. **Receipt and confidentiality:** a report arrives privately on
`[email protected]`. Treat all specifics as confidential, and acknowledge
receipt to the reporter. *(manual)*
+2. **Triage:** verify each claim against the current code, the supported
branches and the git history; assess scope and severity. Decide valid, invalid
or duplicate. [`/oss-triage-security-report`]
+3. **Reserve a CVE:** if valid, the PMC reserves a CVE ID through
https://cveprocess.apache.org. *(manual; the OSS Helper never reserves IDs)*
+4. **Fix:** file a neutral Jira issue, fix it on `main` without referencing
the vulnerability in public commits or PRs, then backport it to every supported
maintenance branch. [`/oss-create-issue`, `/oss-fix-issue`, `/oss-backport-pr`]
+5. **Release:** cut and vote the fixed releases through the normal ASF release
process, so that patched versions are available before disclosure. *(manual)*
+6. **Draft and sign the advisory:** draft `CVE-YYYY-NNNNN.md` and the matching
`.txt` body from the triage notes and the fix PR, then clearsign the `.txt`
into `.txt.asc`. [`/oss-draft-cve` for the draft; signing is manual]
+7. **Publish:** commit the `.md` page and the `.txt.asc` to
`apache/camel-website` under `content/security/`, so that the advisory appears
at `https://camel.apache.org/security/CVE-YYYY-NNNNN.html`. *(manual)*
+8. **Announce and register:** announce to `[email protected]`,
`[email protected]` and `[email protected]`, and let the ASF
Security Team publish the CVE record. *(manual)*
+
+For a CVE in a third-party dependency rather than in Camel's own code, use
`/oss-analyze-third-party-cve` to decide the exposure, and whether a dependency
upgrade or a documented "not affected" note is the right outcome.
