SECURITY.md update to follow CRA template - #2846
Conversation
GitHub Actions
Inactive
📝 WalkthroughSummary by CodeRabbit
WalkthroughSECURITY.md replaces its short vulnerability-report template with a structured checklist, adds response timeline and contact guidance, reformats expectations, and appends an EU Cyber Resilience Act open-source steward statement. ChangesSecurity Guidance
Estimated code review effort: 1 (Trivial) | ~5 minutes Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the SECURITY.md file to expand on the required details for reporting vulnerabilities, add a response timeline, clarify supported versions, and include an EU Cyber Resilience Act steward statement. Feedback was provided regarding a contradiction between the newly added response timeline (1 week) and the existing expectation section (48 hours) for acknowledging reports, suggesting they be aligned.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
GitHub Actions
Inactive
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@SECURITY.md`:
- Around line 47-52: Update the EU Cyber Resilience Act statement to use the
hyphenated legal term “open-source software steward” in the steward description,
leaving the surrounding attribution and links unchanged.
- Around line 25-39: Make the acknowledgement SLA consistent between “Response
Timeline” and “What to Expect” in SECURITY.md: either use the same timeframe in
both sections or clarify that the 48-hour commitment covers receipt
acknowledgement while the one-week commitment covers a later assessment or
triage update.
- Around line 29-33: Update the Contact Information section in SECURITY.md to
explicitly document how security incidents should be reported, stating whether
they use the existing security advisory page or a separate
steward/infrastructure escalation route. Keep the vulnerability-reporting
guidance intact and make the incident path unambiguous.
- Around line 43-45: Update the Supported Versions section in SECURITY.md to
link directly to the project’s support matrix or lifecycle policy, ensuring
readers can find supported release lines, EOL dates, and documented backport
exceptions while preserving the existing security-support wording.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| ### Supported Versions | ||
|
|
||
| We regularly perform patch releases for the supported [latest version](https://github.com/containers/ramalama/releases), which contains fixes for relevant security vulnerabilities and important bugs. Prior releases might receive critical security fixes on a best-effort basis. However, we cannot guarantee that security fixes will get back-ported to these unsupported versions, unless stated otherwise. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== SECURITY.md excerpt ==\n'
nl -ba SECURITY.md | sed -n '1,120p'
printf '\n== Search for support matrix / lifecycle references ==\n'
rg -n --hidden --no-ignore-vcs -S "support matrix|lifecycle|EOL|end[- ]of[- ]life|supported versions|backport|security fixes|security policy" .Repository: containers/ramalama
Length of output: 224
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== SECURITY.md excerpt ==\n'
awk 'NR>=1 && NR<=120 {printf "%4d %s\n", NR, $0}' SECURITY.md
printf '\n== Search for support matrix / lifecycle references ==\n'
rg -n --hidden --no-ignore-vcs -S "support matrix|lifecycle|EOL|end[- ]of[- ]life|supported versions|backport|security fixes|security policy|support period" .Repository: containers/ramalama
Length of output: 50376
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '== SECURITY.md lines 35-55 ==\n'
awk 'NR>=35 && NR<=55 {printf "%4d %s\n", NR, $0}' SECURITY.md
printf '\n== Support/lifecycle references in docs and top-level policy files ==\n'
rg -n --hidden --no-ignore-vcs -S \
"support matrix|lifecycle|EOL|end[- ]of[- ]life|supported versions|backport|security fixes|support period|release lines|maintenance" \
SECURITY.md README* docs/ .github/ . 2>/dev/null | head -n 200Repository: containers/ramalama
Length of output: 50376
Link the support matrix or lifecycle policy here. The current text only points to the latest release and a general security policy; it still doesn’t identify supported release lines, EOL dates, or where backport exceptions are tracked.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@SECURITY.md` around lines 43 - 45, Update the Supported Versions section in
SECURITY.md to link directly to the project’s support matrix or lifecycle
policy, ensuring readers can find supported release lines, EOL dates, and
documented backport exceptions while preserving the existing security-support
wording.
| ## EU Cyber Resilience Act — Open Source Steward Statement | ||
|
|
||
| This project is stewarded by **Red Hat, Inc.**, an open source software steward as defined in Article 3(14) of the [EU Cyber Resilience Act (Regulation 2024/2847)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng). | ||
| Contact: [cra-steward@redhat.com](mailto:cra-steward@redhat.com) | ||
|
|
||
| Refer to [Red Hat's security practices and vulnerability management policy](https://access.redhat.com/security/) for detailed information. No newline at end of file |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Use the CRA’s hyphenated legal term.
Change “open source software steward” to “open-source software steward” on Line [49] to match the terminology defined in Article 3(14). (eur-lex.europa.eu)
🧰 Tools
🪛 LanguageTool
[grammar] ~49-~49: Use a hyphen to join words.
Context: ... stewarded by Red Hat, Inc., an open source software steward as defined in Ar...
(QB_NEW_EN_HYPHEN)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@SECURITY.md` around lines 47 - 52, Update the EU Cyber Resilience Act
statement to use the hyphenated legal term “open-source software steward” in the
steward description, leaving the surrounding attribution and links unchanged.
Source: Linters/SAST tools
3929a64 to
e439df3
Compare
GitHub Actions
Inactive
|
|
||
| Thank you for helping keep RamaLama and its users secure! | ||
|
|
||
| ### Supported Versions |
There was a problem hiding this comment.
Does this apply? We currently just have a rolling latest version, no supported versions to backport to.
Signed-off-by: dominikkawka <dominikkawka2002@gmail.com> Update SECURITY.md Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> Signed-off-by: Dominik Kawka <31955648+dominikkawka@users.noreply.github.com> Signed-off-by: dominikkawka <dominikkawka2002@gmail.com> updates to SECURITY.md Signed-off-by: dominikkawka <dominikkawka2002@gmail.com>
e439df3 to
36a7a58
Compare
GitHub Actions
Inactive
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@SECURITY.md`:
- Line 15: Update the “Reporter Details” section in SECURITY.md to mark the
reporter’s identity and affiliation as optional, and explicitly state that
security reports may be submitted anonymously. Apply the same clarification to
the corresponding reporter-details text at the referenced later section.
- Around line 12-13: Update the vulnerability-reporting instructions in
SECURITY.md and the corresponding section of CONTRIBUTING.md to use one
identical authoritative reporting route, preferably the process defined in
containers/common/SECURITY.md. Replace the conflicting GitHub Security Advisory
link and ensure both documents consistently direct reporters through the
selected process.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| 1. Go to [our security advisory page](https://github.com/containers/ramalama/security/advisories/new) to privately report the vulnerability. | ||
| 2. Provide detailed information about the vulnerability, including: |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Align the reporting route with CONTRIBUTING.md.
CONTRIBUTING.md tells reporters to use the process in containers/common/SECURITY.md, while these lines direct them to RamaLama’s GitHub Security Advisory page. Choose one authoritative route and update both documents consistently; otherwise reports may be misdirected or delayed.
Also applies to: 33-34
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@SECURITY.md` around lines 12 - 13, Update the vulnerability-reporting
instructions in SECURITY.md and the corresponding section of CONTRIBUTING.md to
use one identical authoritative reporting route, preferably the process defined
in containers/common/SECURITY.md. Replace the conflicting GitHub Security
Advisory link and ensure both documents consistently direct reporters through
the selected process.
There was a problem hiding this comment.
+1, Shall I update the CONTRIBUTING.md to include the GitHub advisory page
There was a problem hiding this comment.
Seems like the humans are having a chat. I'll hop back into my burrow for now. If you need me again, just tag @coderabbitai in a new comment, and I'll come hopping out!
GitHub Actions
Inactive
2 participants
https://github.com/RedHatProductSecurity/CRA/blob/main/Templates/Security_MD_template.md
https://access.redhat.com/security/eu-cyber-resilience-act-stewardship-guidelines