From 4f194f30949a5208bf6f4eca8810c924333fc07f Mon Sep 17 00:00:00 2001 From: Michael Dawson Date: Wed, 26 Jan 2022 12:11:15 -0500 Subject: [PATCH] doc: add security-steward rotation information Add information about security stewards and rotation. Signed-off-by: Michael Dawson PR-URL: https://github.com/nodejs/node/pull/41707 Reviewed-By: Matteo Collina Reviewed-By: Vladimir de Turckheim Reviewed-By: Bryan English Reviewed-By: Mohammed Keyvanzadeh Reviewed-By: James M Snell Reviewed-By: Rich Trott --- README.md | 24 ++++++++++++++++++++ doc/contributing/security-release-process.md | 22 ++++++++++++++++++ 2 files changed, 46 insertions(+) diff --git a/README.md b/README.md index 81e18020da0564..ba735c9798bfbc 100644 --- a/README.md +++ b/README.md @@ -732,6 +732,30 @@ use these keys to verify a downloaded file. +### Security release stewards + +When possible, the commitment to take slots in the +security release steward rotation is made by companies in order +to ensure individuals who act as security stewards have the +support and recognition from their employer to be able to +prioritize security releases. Security release stewards manage security +releases on a rotation basis as outlined in the +[security release process](./doc/contributing/security-release-process.md). + +* Datadog + * [bengl](https://github.com/bengl) - + **Bryan English** <> (he/him) + * [vdeturckheim](https://github.com/vdeturckheim) - + **Vladimir de Turckheim** <> (he/him) +* NearForm + * [mcollina](https://github.com/mcollina) - + **Matteo Collina** <> (he/him) +* Red Hat and IBM + * [joesepi](https://github.com/joesepi)- + **Joe Sepi** <> (he/him) + * [mhdawson](https://github.com/mhdawson) - + **Michael Dawson** <> (he/him) + ## License Node.js is available under the diff --git a/doc/contributing/security-release-process.md b/doc/contributing/security-release-process.md index 7fbf68152dd125..6aee4655ad75b8 100644 --- a/doc/contributing/security-release-process.md +++ b/doc/contributing/security-release-process.md @@ -6,6 +6,28 @@ Security Release and used to track progress on the release. It contains _**TEXT LIKE THIS**_ which will be replaced during the release process with the information described. +## Security release stewards + +For each security release, a security steward will take ownership for +coordinating the steps outlined in this process. Security stewards +are nominated through an issue in the TSC repository and approved +through the regular TSC consensus process. Once approved, they +are given access to all of the resources needed to carry out the +steps listed in the process as outlined in +[security steward on/off boarding](security-steward-on-off-boarding.md). + +The current security stewards are documented in the main Node.js +[README.md](https://github.com/nodejs/node#security-release-stewards). + +| Company | Person | Release Date | +| ---------- | -------- | ------------ | +| NearForm | Matteo | 2021-Oct-12 | +| Datadog | Bryan | 2022-Jan-10 | +| RH and IBM | Joe | | +| NearForm | Matteo | | +| Datadog | Vladimir | | +| RH and IBM | Michael | | + ## Planning * [ ] Open an [issue](https://github.com/nodejs-private/node-private) titled