security-policy: the Kubernetes SECURITY_CONTACTS convention and a SECURITY.md with an obfuscated address + PGP fingerprint are not recognised

Offen
  • Stimmt etwas nicht?
#242 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
3/5
Geschätzter Aufwand
1-2 Tage
Anfängerfreundlichkeit
45/100
Issue-Typ
Bug
Klarheit
Größtenteils klar
Aktivitätsstatus
Aktiv
Tech-Stack
python
Bereich
devtools, security

Rechercherichtung

The payload does not name the source file that implements the security-policy check, so first locate it in the Python validator. Reproduce the two cases: a directory containing only a SECURITY_CONTACTS file with the two Kubernetes header lines, and a SECURITY.md with a ## Reporting a Vulnerability heading and an obfuscated address. Done when both produce the expected result and the expectations in corpus/ are updated to match. The issue leaves open whether the heading alone should count, so confirm that with maintainers first.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

kubespray follows the Kubernetes organisation's SECURITY_CONTACTS file (header points to kubernetes.io/security, private reporting to the Product Security Committee) → WARN "no security policy"; Catch2's SECURITY.md has a "Reporting a Vulnerability" section with a spam-obfuscated email and a PGP fingerprint → WARN "does not say how to report".

Evidence from the corpus audit

kubernetes-sigs/kubespray / security-policy
  • kind: UNSUPPORTED
  • actual: WARN "no security policy / add a SECURITY.md that says how to report a vulnerability privately"
  • expected: PASS or at least a mention: the repository follows the Kubernetes-organisation convention,
    SECURITY_CONTACTS, whose header tells reporters to follow https://kubernetes.io/security/ (private reporting to
    the Kubernetes Product Security Committee). Every kubernetes/ and kubernetes-sigs/ repository has this file
    (kubernetes/examples in this batch has both and passes on its SECURITY.md).
  • evidence: SECURITY_CONTACTS:10-11: # DO NOT REPORT SECURITY VULNERABILITIES DIRECTLY TO THESE NAMES, FOLLOW THE /
    # INSTRUCTIONS AT https://kubernetes.io/security/; find . -iname 'SECURITY*' → only ./SECURITY_CONTACTS.
  • repro: a repo with SECURITY_CONTACTS containing those two header lines and no SECURITY.md.
  • confidence: medium
catchorg/Catch2 / security-policy
  • kind: FALSE_NEGATIVE
  • actual: WARN: SECURITY.md does not say how to report a vulnerability
  • expected: PASS: SECURITY.md has a "Reporting a Vulnerability" section with a (spam-obfuscated) email address and
    a PGP fingerprint.
  • evidence: SECURITY.md:12: ## Reporting a Vulnerability; :18-20: However, if you find one you send email to martin <dot> horenovsky <at> / gmail <dot> com. If you want to encrypt the email, my pgp key is /
    `E29C 46F3 B8A7 5028 6079 3B7D ECC9 C20E 314B 2360`.
  • repro: a SECURITY.md with "## Reporting a Vulnerability" and name <at> example <dot> com; expect PASS (or
    accept the heading alone as "says how").
  • confidence: medium

Found by the regression-corpus audit (235 real repositories, one or more per ecosystem profile; corpus and expected results in corpus/). Evidence is quoted from the audited checkouts at the commits pinned in corpus/projects.toml; <checkouts>/<owner>__<repo> is such a checkout.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ByTXNqDWdM7HzezrFtEvQt

Vorherrschende Sprache
Python
Sterne
4
Forks
1
Ø Merge
10 Std. 41 Min.
Gemergte PRs (30 T.)
79

Entwicklungsumgebung

Dieses Projekt bietet weder Dev-Container noch Dockerfile noch Beitragsleitfaden – die Einrichtung liegt bei Ihnen. Beginnen Sie mit der README; die allgemeinen Schritte stehen in unserem Leitfaden für den ersten Beitrag.

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus cpp-best-practices/project_validator

Alle Issues in cpp-best-practices/project_validator

Ähnliche Issues

Weitere Issues zu Python

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.