{"thread":{"id":"48007","subject":"[PATCH] git manpage: note git-security@googlegroups.com","startedAt":"2018-03-08T15:08:36Z","lastAt":"2018-03-08T19:29:41Z","messageCount":2,"participants":["Ævar Arnfjörð Bjarmason","Junio C Hamano"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"341290","messageId":"20180308150820.22588-1-avarab@gmail.com","threadId":"48007","inReplyTo":null,"subject":"[PATCH] git manpage: note git-security@googlegroups.com","fromName":"Ævar Arnfjörð Bjarmason","fromEmail":"avarab@gmail.com","sentAt":"2018-03-08T15:08:20Z","receivedAt":"2018-03-08T15:08:36Z","isPatch":true,"sender":{"key":"avarab@gmail.com","avatar":"https://avatars.githubusercontent.com/u/45301?v=4"},"body":"Add a mention of the security mailing list to the \"Reporting Bugs\"\nsection. There's a mention of this list at\nhttps://git-scm.com/community but none in git.git itself.\n\nThe copy is pasted from the git-scm.com website. Let's use the same\nwording in both places.\n\nSigned-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com>\n---\nSomeone at Git Merge mentioned that our own docs have no mention of\nhow to report security issues. Perhaps this should be in\nSubmittingPatches too, but I couldn't figure out how that magical\nfootnote format works.\n\n Documentation/git.txt | 3 +++\n 1 file changed, 3 insertions(+)\n\ndiff --git a/Documentation/git.txt b/Documentation/git.txt\nindex 8163b5796b..4767860e72 100644\n--- a/Documentation/git.txt\n+++ b/Documentation/git.txt\n@@ -849,6 +849,9 @@ Report bugs to the Git mailing list <git@vger.kernel.org> where the\n development and maintenance is primarily done.  You do not have to be\n subscribed to the list to send a message there.\n \n+Issues which are security relevant should be disclosed privately to\n+the Git Security mailing list <git-security@googlegroups.com>.\n+\n SEE ALSO\n --------\n linkgit:gittutorial[7], linkgit:gittutorial-2[7],\n-- \n2.15.1.424.g9478a66081\n\n"},{"id":"341310","messageId":"xmqqmuziweld.fsf@gitster-ct.c.googlers.com","threadId":"48007","inReplyTo":"20180308150820.22588-1-avarab@gmail.com","subject":"Re: [PATCH] git manpage: note git-security@googlegroups.com","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2018-03-08T19:29:34Z","receivedAt":"2018-03-08T19:29:41Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Ævar Arnfjörð Bjarmason  <avarab@gmail.com> writes:\n\n> Add a mention of the security mailing list to the \"Reporting Bugs\"\n> section. There's a mention of this list at\n> https://git-scm.com/community but none in git.git itself.\n\nThis is quite a sensible thing to do.\n\n>\n> The copy is pasted from the git-scm.com website. Let's use the same\n> wording in both places.\n>\n> Signed-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com>\n> ---\n> Someone at Git Merge mentioned that our own docs have no mention of\n> how to report security issues. Perhaps this should be in\n> SubmittingPatches too, but I couldn't figure out how that magical\n> footnote format works.\n\nThe \"Notes from the maintainer\" posted periodically here for\ndevelopers does mention it, and I do agree with you that\nSubmittingPatches is a good place to add it, as it is a document\nthat is targetted more towards developers.  But this is a good first\nstep.\n\nWill queue.\n\n>\n>  Documentation/git.txt | 3 +++\n>  1 file changed, 3 insertions(+)\n>\n> diff --git a/Documentation/git.txt b/Documentation/git.txt\n> index 8163b5796b..4767860e72 100644\n> --- a/Documentation/git.txt\n> +++ b/Documentation/git.txt\n> @@ -849,6 +849,9 @@ Report bugs to the Git mailing list <git@vger.kernel.org> where the\n>  development and maintenance is primarily done.  You do not have to be\n>  subscribed to the list to send a message there.\n>  \n> +Issues which are security relevant should be disclosed privately to\n> +the Git Security mailing list <git-security@googlegroups.com>.\n> +\n>  SEE ALSO\n>  --------\n>  linkgit:gittutorial[7], linkgit:gittutorial-2[7],\n"}]}