note git-security@googlegroups.com in more places
Add a mention of the security mailing list to the README, and to Documentation/SubmittingPatches.. 2caa7b8d27 ("git manpage: note git-security@googlegroups.com", 2018-03-08) already added it to the man page, but for developers either the README, or the documentation on how to contribute (SubmittingPatches) may be the first place to look. Use the same wording as we already have on the git-scm.com website and in the man page for the README, while the wording is adjusted in SubmittingPatches to match the surrounding document better. Signed-off-by: Thomas Gummerer <t.gummerer@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Thomas Gummerer committed
May 30, 2018 at 21:52 UTC
2a00502b14cd88299c8e69abcedf8aadcfaaaa6e
2 files changed
+16
Documentation/SubmittingPatches
+13
@@ -176,6 +176,12 @@ that is fine, but please mark it as such.
176
[[send-patches]]
177
=== Sending your patches.
178
179
+:security-ml: footnoteref:[security-ml,The Git Security mailing list: git-security@googlegroups.com]
180
+
181
+Before sending any patches, please note that patches that may be
182
+security relevant should be submitted privately to the Git Security
183
+mailing list{security-ml}, instead of the public mailing list.
184
+
185
Learn to use format-patch and send-email if possible. These commands
186
are optimized for the workflow of sending patches, avoiding many ways
187
your existing e-mail client that is optimized for "multipart/*" mime
@@ -259,6 +265,13 @@ patch, format it as "multipart/signed", not a text/plain message
265
that starts with `-----BEGIN PGP SIGNED MESSAGE-----`. That is
266
not a text/plain, it's something else.
267
268
+:security-ml-ref: footnoteref:[security-ml]
269
+
270
+As mentioned at the beginning of the section, patches that may be
271
+security relevant should not be submitted to the public mailing list
272
+mentioned below, but should instead be sent privately to the Git
273
+Security mailing list{security-ml-ref}.
274
+
275
Send your patch with "To:" set to the mailing list, with "cc:" listing
276
people who are involved in the area you are touching (the output from
277
`git blame $path` and `git shortlog --no-merges $path` would help to
README.md
+3
@@ -36,6 +36,9 @@ the body to majordomo@vger.kernel.org. The mailing list archives are
36
available at <https://public-inbox.org/git/>,
37
<http://marc.info/?l=git> and other archival sites.
38
39
+Issues which are security relevant should be disclosed privately to
40
+the Git Security mailing list <git-security@googlegroups.com>.
41
+
42
The maintainer frequently sends the "What's cooking" reports that
43
list the current status of various development topics to the mailing
44
list. The discussion following them give a good reference for