Skip to content

SECURITY.md update to follow CRA template #2846

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dominikkawka wants to merge 3 commits into
base: main
Choose a base branch
from
Open

SECURITY.md update to follow CRA template #2846

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
36a7a58
SECURITY.md update to follow CRA template
dominikkawka Jul 16, 2026
ba13936
Merge branch 'containers:main' into ramalamaCRA
dominikkawka Jul 30, 2026
f0a9a71
Security related issues to match CRA Compliance
dominikkawka Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ Reproducers make finding and fixing issues much easier for maintainers.
The easier it is for us to reproduce a bug, the faster it'll be fixed!

Please don't include any private/sensitive information in your issue!
Security issues should NOT be reported via Github and should instead be reported via the process described [here](https://github.com/containers/common/blob/main/SECURITY.md).
Direct all security questions and vulnerability reports to the [security advisory page](https://github.com/containers/ramalama/security/advisories/new).

## Working On Issues

Expand Down
29 changes: 25 additions & 4 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,17 +11,38 @@ mailing list, or IRC. Please do **not** create a public issue.

1. Go to [our security advisory page](https://github.com/containers/ramalama/security/advisories/new) to privately report the vulnerability.
2. Provide detailed information about the vulnerability, including:
Comment thread
dominikkawka marked this conversation as resolved.
- Description of the issue
- Steps to reproduce
- Potential impact
- Suggested fix (if available)
- **Title**: A concise, descriptive summary of the issue.
- **Reporter Details**: Your name/handle and affiliation.
Comment thread
coderabbitai[bot] marked this conversation as resolved.
- **Technical Description**: Detailed information regarding the vulnerability.
- **Affected Versions**: The specific version(s) or range(s) of software tested.
- **Reproduction Steps**: A minimal, functional example to reproduce the issue.
- **Impact Assessment**: Potential exploit scenarios and perceived severity. (optional)
- **Suggested Fix**: Any proposed patches or mitigations (optional).
- **Disclosure Status**: Whether this has been shared with other parties or published and your plan for future sharing (e.g., at a conference).

Your report will be reviewed by the maintainers, and we will work with you to understand and address the issue promptly.

### Response Timeline

We aim to provide an initial acknowledgement of your report within 48 hours.

Our goal is to assess the report, coordinate fix and disclosure as quickly as possible. All confirmed security vulnerabilities and incidents will be addressed according to severity level and impact on the project.

### Contact Information

Direct all security questions and vulnerability reports to the [security advisory page](https://github.com/containers/ramalama/security/advisories/new)
Comment thread
coderabbitai[bot] marked this conversation as resolved.

### What to Expect

- **Acknowledgment**: We will acknowledge receipt of your vulnerability report within 48 hours
- **Updates**: We will keep you informed about our progress in addressing the vulnerability
- **Credit**: We will credit you for the discovery when we publish the fix (unless you prefer to remain anonymous)
Comment thread
coderabbitai[bot] marked this conversation as resolved.

Thank you for helping keep RamaLama and its users secure!

## EU Cyber Resilience Act — Open Source Steward Statement

This project is stewarded by **Red Hat, Inc.**, an open source software steward as defined in Article 3(14) of the [EU Cyber Resilience Act (Regulation 2024/2847)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng).
Contact: [cra-steward@redhat.com](mailto:cra-steward@redhat.com)

Refer to [Red Hat's security practices and vulnerability management policy](https://access.redhat.com/security/) for detailed information.
Comment on lines +43 to +48

@coderabbitai coderabbitai Bot Jul 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Use the CRA’s hyphenated legal term.

Change “open source software steward” to “open-source software steward” on Line [49] to match the terminology defined in Article 3(14). (eur-lex.europa.eu)

🧰 Tools
🪛 LanguageTool

[grammar] ~49-~49: Use a hyphen to join words.
Context: ... stewarded by Red Hat, Inc., an open source software steward as defined in Ar...

(QB_NEW_EN_HYPHEN)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@SECURITY.md` around lines 47 - 52, Update the EU Cyber Resilience Act
statement to use the hyphenated legal term “open-source software steward” in the
steward description, leaving the surrounding attribution and links unchanged.

Source: Linters/SAST tools

Loading