[Feature] A channel someone can subscribe to for security notifications #552

New issue

Closed

opened 2026-07-22 13:43:48 +00:00 by brenno · 0 comments

brenno commented

2026-07-22 13:43:48 +00:00

Owner

The light-weight attestation (#549) asks for one thing we cannot supply: how to subscribe to receive the project's public security notifications (an RSS feed, a mailing list — proposals/gen-two-tier-approach.md, Light Weight summary). We answer the opposite twice, deliberately: docs/FAQ.md:311 and docs/MIGRATION_GUIDE.md:84 both state there is no forum, no support channel and no mailing list.

That answer is right for support and wrong for security. Steering questions to the tracker instead of a chat channel is a defensible choice by one maintainer. But a fixed vulnerability is push, not pull: the person who needs to know is not watching the tracker, and SECURITY.md currently offers them nothing to follow. Annex I Part II.4 (disclosing fixed vulnerabilities) and II.6 (sharing vulnerability information) are both listed as satisfied by "CHANGELOG and the tracker are public" in assurance/CRA-2024-2847-positie.md — public, but not subscribable.

The cheap route exists already. Forgejo serves Atom and RSS per repository: releases, tags, and the activity feed each have a feed URL. No mailing list to run, no addresses to hold — which also keeps it clean under the GDPR, because a subscriber list is personal data and a feed is not. That asymmetry should decide it.

What this issue delivers

Pick the feed that carries security news rather than all traffic — most likely releases/tags once #520 exists, and until then a documented alternative that is honest about what it does and does not carry.
Name it in SECURITY.md, under What to expect or beside it, with the actual URL.
Correct the two flat statements in docs/FAQ.md and docs/MIGRATION_GUIDE.md: no discussion channel, but this is where you hear about a fix. Date the correction, as the rest of those files do.
Decide whether a fixed vulnerability gets a marked entry in CHANGELOG.md — a feed only helps if the item in it is recognisable as security news.

Depends on nothing, but pairs with #520. A releases feed is empty until there are releases; that is a reason to choose the feed carefully, not a reason to wait.

The light-weight attestation (#549) asks for one thing we cannot supply: **how to subscribe to receive the project's public security notifications** (an RSS feed, a mailing list — `proposals/gen-two-tier-approach.md`, Light Weight summary). We answer the opposite twice, deliberately: `docs/FAQ.md:311` and `docs/MIGRATION_GUIDE.md:84` both state there is no forum, no support channel and no mailing list. **That answer is right for support and wrong for security.** Steering questions to the tracker instead of a chat channel is a defensible choice by one maintainer. But a fixed vulnerability is push, not pull: the person who needs to know is not watching the tracker, and `SECURITY.md` currently offers them nothing to follow. Annex I Part II.4 (disclosing fixed vulnerabilities) and II.6 (sharing vulnerability information) are both listed as satisfied by "CHANGELOG and the tracker are public" in [`assurance/CRA-2024-2847-positie.md`](assurance/CRA-2024-2847-positie.md) — public, but not subscribable. **The cheap route exists already.** Forgejo serves Atom and RSS per repository: releases, tags, and the activity feed each have a feed URL. No mailing list to run, no addresses to hold — which also keeps it clean under the GDPR, because a subscriber list is personal data and a feed is not. That asymmetry should decide it. **What this issue delivers** - Pick the feed that carries security news rather than all traffic — most likely releases/tags once #520 exists, and until then a documented alternative that is honest about what it does and does not carry. - Name it in `SECURITY.md`, under **What to expect** or beside it, with the actual URL. - Correct the two flat statements in `docs/FAQ.md` and `docs/MIGRATION_GUIDE.md`: no discussion channel, *but* this is where you hear about a fix. Date the correction, as the rest of those files do. - Decide whether a fixed vulnerability gets a marked entry in `CHANGELOG.md` — a feed only helps if the item in it is recognisable as security news. **Depends on nothing, but pairs with #520.** A releases feed is empty until there are releases; that is a reason to choose the feed carefully, not a reason to wait.

brenno added the

triage

enhancement

labels

2026-07-22 13:43:48 +00:00

brenno referenced this issue

2026-07-22 13:44:35 +00:00

[Feature] Machine-readable project metadata, so a third party can attest without asking #555

brenno referenced this issue from a commit

2026-07-22 15:40:44 +00:00

docs(security): zeg wat er gebeurt als dit project stopt, en wat je kunt volgen

brenno referenced this issue from a pull request that will close it,