[PATCH 0/3] securityprocess: Instruct submitters to avoid
Rendered output can be looked at at: https://pipo.sk.gitlab.io/-/libvirt/-/jobs/15809868791/artifacts/website/sec... (I still refuse to change my username on gitlab thus sorry for having to agree to broken TLS) Peter Krempa (3): css: generic: Add support for '.. important::' RST admonition docs: securityprocess: Convert planin 'Note' paragraph to rST admonition docs: securityprocess: Instruct security issue submitters to avoid archives docs/css/generic.css | 1 + docs/securityprocess.rst | 11 ++++++++--- 2 files changed, 9 insertions(+), 3 deletions(-) -- 2.55.0
From: Peter Krempa <pkrempa@redhat.com> Use the same heading color as we do for '.. warning::'. Signed-off-by: Peter Krempa <pkrempa@redhat.com> --- docs/css/generic.css | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/css/generic.css b/docs/css/generic.css index 87cd94d9f4..121f8bec65 100644 --- a/docs/css/generic.css +++ b/docs/css/generic.css @@ -111,6 +111,7 @@ aside.admonition { background: #6cb5ac; } +.important .admonition-title, .warning .admonition-title { margin: 0; padding: 0.5em 1em 0.5em 1em; -- 2.55.0
On Mon, Aug 10, 2026 at 04:22:39PM +0200, Peter Krempa via Devel wrote:
From: Peter Krempa <pkrempa@redhat.com>
Use the same heading color as we do for '.. warning::'.
Signed-off-by: Peter Krempa <pkrempa@redhat.com> --- docs/css/generic.css | 1 + 1 file changed, 1 insertion(+)
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> With regards, Daniel -- |: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|
From: Peter Krempa <pkrempa@redhat.com> Signed-off-by: Peter Krempa <pkrempa@redhat.com> --- docs/securityprocess.rst | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/securityprocess.rst b/docs/securityprocess.rst index c7fd9b7ae1..b9fa8d9890 100644 --- a/docs/securityprocess.rst +++ b/docs/securityprocess.rst @@ -28,9 +28,10 @@ patch is considered ready to post to the mailing list or a merge request, the ``confidential`` tag will be removed. Generally a CVE should be assigned to a security issue before a patch is ready to be posted (see below). -Note: Refer to the `bug reporting <bugs.html#use-of-automated-tools-ai-agents>`__ -page for the *expectations around the use of automated tools and AI agents*, -**prior** to filing any security report. +.. note:: + Refer to the `bug reporting <bugs.html#use-of-automated-tools-ai-agents>`__ + page for the *expectations around the use of automated tools and AI agents*, + **prior** to filing any security report. Security notices ---------------- -- 2.55.0
On Mon, Aug 10, 2026 at 04:22:40PM +0200, Peter Krempa via Devel wrote:
From: Peter Krempa <pkrempa@redhat.com>
Signed-off-by: Peter Krempa <pkrempa@redhat.com> --- docs/securityprocess.rst | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> With regards, Daniel -- |: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|
$SUBJECT s/planin/plain/ On Mon, Aug 10, 2026 at 04:22:40PM +0200, Peter Krempa via Devel wrote:
From: Peter Krempa <pkrempa@redhat.com>
Signed-off-by: Peter Krempa <pkrempa@redhat.com> --- docs/securityprocess.rst | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/docs/securityprocess.rst b/docs/securityprocess.rst index c7fd9b7ae1..b9fa8d9890 100644 --- a/docs/securityprocess.rst +++ b/docs/securityprocess.rst @@ -28,9 +28,10 @@ patch is considered ready to post to the mailing list or a merge request, the ``confidential`` tag will be removed. Generally a CVE should be assigned to a security issue before a patch is ready to be posted (see below).
-Note: Refer to the `bug reporting <bugs.html#use-of-automated-tools-ai-agents>`__ -page for the *expectations around the use of automated tools and AI agents*, -**prior** to filing any security report. +.. note:: + Refer to the `bug reporting <bugs.html#use-of-automated-tools-ai-agents>`__ + page for the *expectations around the use of automated tools and AI agents*, + **prior** to filing any security report.
Security notices ---------------- -- 2.55.0
With regards, Daniel -- |: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|
From: Peter Krempa <pkrempa@redhat.com> Archives (as witnessed by recent reports) hide useful information by requiring the maintainer to download the archive which may be dangerous. Recent submissions also contained a lot of fluff inside the archives. Instruct submitters of security issues to attach files directly instead of hiding them in an archive. Signed-off-by: Peter Krempa <pkrempa@redhat.com> --- docs/securityprocess.rst | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/securityprocess.rst b/docs/securityprocess.rst index b9fa8d9890..d1e7fcc424 100644 --- a/docs/securityprocess.rst +++ b/docs/securityprocess.rst @@ -20,6 +20,10 @@ apply to the core project. Ensure that the "**turn on confidentiality**" checkbox is selected prior to submitting the issue, to restrict visibility to project maintainers only. +.. important:: + Only attach plain files, do not bundle files in archives without prior request + from a libvirt maintainer. + Maintainer(s) will analyse the reported disclosure and decide whether it is to be classed as a security flaw or not. If not a security flaw, the ``confidential`` tag will be removed immediately. If a security flaw, -- 2.55.0
On Mon, Aug 10, 2026 at 04:22:41PM +0200, Peter Krempa via Devel wrote:
From: Peter Krempa <pkrempa@redhat.com>
Archives (as witnessed by recent reports) hide useful information by requiring the maintainer to download the archive which may be dangerous.
Recent submissions also contained a lot of fluff inside the archives.
Instruct submitters of security issues to attach files directly instead of hiding them in an archive.
Signed-off-by: Peter Krempa <pkrempa@redhat.com> --- docs/securityprocess.rst | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/docs/securityprocess.rst b/docs/securityprocess.rst index b9fa8d9890..d1e7fcc424 100644 --- a/docs/securityprocess.rst +++ b/docs/securityprocess.rst @@ -20,6 +20,10 @@ apply to the core project. Ensure that the "**turn on confidentiality**" checkbox is selected prior to submitting the issue, to restrict visibility to project maintainers only.
+.. important:: + Only attach plain files, do not bundle files in archives without prior request + from a libvirt maintainer.
I wonder if we should be more explicit "..do not bundle files in archives (zip, tar, etc) without prior..." Either way, Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> With regards, Daniel -- |: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|
participants (2)
-
Daniel P. Berrangé -
Peter Krempa