GeezerVison is showing github.com — doc: add extra step for reporter pre-approval · nodejs/node@6ae9bc8
File tree
Expand file treeCollapse file tree
Open diff view settings
Expand file treeCollapse file tree
Open diff view settings
Collapse file
Copy file name to clipboardExpand all lines: doc/contributing/security-release-process.md +6Lines changed: 6 additions & 0 deletions - Display the source diff
- Display the rich diff
| Original file line number | Diff line number | Diff line change |
|---|
@@ -44,6 +44,8 @@ The current security stewards are documented in the main Node.js |
44 | 44 | the date in the slug so that it will move to the top of the blog list.) |
45 | 45 | * (Consider using a [Vulnerability Score System](https://www.first.org/cvss/calculator/3.1) |
46 | 46 | to identify severity of each report) |
| 47 | + * Share the patch with the reporter when applicable. |
| 48 | + It will increase the fix accuracy. |
47 | 49 | * [ ] pre-release: _**LINK TO PR**_ |
48 | 50 | * [ ] post-release: _**LINK TO PR**_ |
49 | 51 | * List vulnerabilities in order of descending severity |
@@ -66,6 +68,10 @@ The current security stewards are documented in the main Node.js |
66 | 68 | * [ ] Check that all vulnerabilities are ready for release integration: |
67 | 69 | * PRs against all affected release lines or cherry-pick clean |
68 | 70 | * Approved |
| 71 | + * (optional) Approved by the reporter |
| 72 | + * Build and send the binary to the reporter according to its architecture |
| 73 | + and ask for a review. This step is important to avoid insufficient fixes |
| 74 | + between Security Releases. |
69 | 75 | * Pass `make test` |
70 | 76 | * Have CVEs |
71 | 77 | * Make sure that dependent libraries have CVEs for their issues. We should |
|