Repository navigation
Introduce a mechanism to reserve OSEC identifiers - #43
Merged
Merged
Conversation
edwintorok
marked this pull request as ready for review
September 28, 2026 13:30
edwintorok
marked this pull request as draft
September 28, 2026 13:33
edwintorok
marked this pull request as ready for review
September 28, 2026 13:38
edwintorok
force-pushed
the
main
branch
2 times, most recently
from
October 28, 2026 09:17
edaee29 to
f3193f3
Compare
Member
|
thanks. all that is needed is a brief paragraph in the README |
When multiple advisories are handled concurrently it might be useful to assign a different OSEC identifier to each (e.g. these may be included into commit messages). Meanwhile other PRs can get created on this repo that may reuse an already assigned identifier (and if a duplicate identifier makes its way into a release it'll be difficult to change later). Make OSEC identifier reservation explicit: * either an empty file * or a regular advisory Advisory reservation is implemented by skipping the file in the 2 workflows. Signed-off-by: Edwin Török <edwin@tarides.com>
Signed-off-by: Edwin Török <edwin@tarides.com>
Signed-off-by: Edwin Török <edwin@etorok.net>
Collaborator
Author
I added another commit for that, and mentioned that this is intended for internal coordination within the security team. |
Reservation is done with an empty file on purpose: to avoid leaking details about vulnerabilities. However this doesn't prevent accidentally mentioning something in the commit message or PR comment. Add a reminder. Signed-off-by: Edwin Török <edwin@etorok.net>
Member
|
thanks |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OSEC advisory identifiers can be reserved by creating an empty
advisories/<year>/OSEC-<year>-NNN.mdfile.Reservations only works with completely empty advisories to avoid leaking details about upcoming vulnerabilities.
The reservation is then considered owned by the person creating the reservation PR, and can be updated with the actual contents once the fix is public. (ownership isn't enforced, but if we consider an OSEC identifier assigned once a PR with an empty file is merged to
mainthen that'll prevent duplicate assignments)This avoids "race conditions" when multiple security reports are in flight, and fixes are released out of order. Projects may wish to embed an OSEC identifier into their commit messages, so it'd be nice if this didn't change, once it has been assigned.