This list is used to provide actionable information to multiple distribution vendors at once. This list is not intended for individuals to find out about security issues.
Members of the security cncf-karmada-distributors-announce@lists.cncf.io mailing list must share list information only within their teams, on a need-to-know basis to get the related issue fixed in their distribution. The information members and others receive from the list must not be made public, shared, nor even hinted at otherwise, except with the list's explicit approval. This holds true until the public disclosure date/time that was agreed upon by the list.
Before any information from the list is shared with respective members of your team required to fix an issue, they must agree to the same terms and only find out information on a need-to-know basis.
In the unfortunate event you share the information beyond what is allowed by this policy, you must urgently inform the Security Team of exactly what information leaked and to whom, as well as the steps that will be taken to prevent future leaks.
Repeated offenses may lead to the removal from the distributors list.
This is a team effort. As a member of the list you must carry some water. This could be in the form of the following:
- Review and/or test the proposed patches and point out potential issues with them (such as incomplete fixes for the originally reported issues, additional issues you might notice, and newly introduced bugs), and inform the list of the work done even if no issues were encountered.
Group membership is managed here, under the Distributors announce section.
To be eligible for the cncf-karmada-distributors-announce@lists.cncf.io mailing list, your distribution should:
- Have an actively monitored security email alias for our project.
- Have a user base not limited to your own organization.
- Have a publicly verifiable track record up to present day of fixing security issues.
- Not be a downstream or rebuild of another distribution.
- Be a participant and active contributor in the Karmada community.
- Accept the Embargo Policy that is outlined above.
- Be willing to contribute back.
- Have someone already on the list vouch for the person requesting membership on behalf of your distribution.
Removal: If your distribution stops meeting one or more of these criteria after joining the list then you will be unsubscribed.
File an issue here, or send an email, filling in the criteria template.