Skip to content
This repository was archived by the owner on Jun 5, 2025. It is now read-only.

Commit 9dfa80c

Browse files
author
Luke Hinds
authored
Merge pull request #347 from stacklok/mds
Add Project MD files
2 parents fddcc71 + 8fa44bd commit 9dfa80c

File tree

3 files changed

+224
-0
lines changed

3 files changed

+224
-0
lines changed

‎CODE_OF_CONDUCT.md

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
# Code of Conduct
2+
3+
## Our Pledge
4+
5+
In the interest of fostering an open and welcoming environment, we as
6+
contributors and maintainers pledge to making participation in our project and
7+
our community a harassment-free experience for everyone, regardless of age, body
8+
size, disability, ethnicity, gender identity and expression, level of experience,
9+
nationality, personal appearance, race, religion, or sexual identity and
10+
orientation.
11+
12+
## Our Standards
13+
14+
Examples of behavior that contributes to creating a positive environment
15+
include:
16+
17+
* Using welcoming and inclusive language
18+
* Being respectful of differing viewpoints and experiences
19+
* Gracefully accepting constructive criticism
20+
* Focusing on what is best for the community
21+
* Showing empathy towards other community members
22+
23+
Examples of unacceptable behavior by participants include:
24+
25+
* The use of sexualized language or imagery and unwelcome sexual attention or
26+
advances
27+
* Trolling, insulting/derogatory comments, and personal or political attacks
28+
* Public or private harassment
29+
* Publishing others' private information, such as a physical or electronic
30+
address, without explicit permission
31+
* Other conduct which could reasonably be considered inappropriate in a
32+
professional setting
33+
34+
## Our Responsibilities
35+
36+
Project maintainers are responsible for clarifying the standards of acceptable
37+
behavior and are expected to take appropriate and fair corrective action in
38+
response to any instances of unacceptable behavior.
39+
40+
Project maintainers have the right and responsibility to remove, edit, or
41+
reject comments, commits, code, wiki edits, issues, and other contributions
42+
that are not aligned to this Code of Conduct, or to ban temporarily or
43+
permanently any contributor for other behaviors that they deem inappropriate,
44+
threatening, offensive, or harmful.
45+
46+
## Scope
47+
48+
This Code of Conduct applies both within project spaces and in public spaces
49+
when an individual is representing the project or its community. Examples of
50+
representing a project or community include using an official project e-mail
51+
address, posting via an official social media account, or acting as an appointed
52+
representative at an online or offline event. Representation of a project may be
53+
further defined and clarified by project maintainers.
54+
55+
## Enforcement
56+
57+
Instances of abusive, harassing, or otherwise unacceptable behavior may be
58+
reported by contacting the project team at <[email protected]>. All
59+
complaints will be reviewed and investigated and will result in a response that
60+
is deemed necessary and appropriate to the circumstances. The project team is
61+
obligated to maintain confidentiality with regard to the reporter of an incident.
62+
Further details of specific enforcement policies may be posted separately.
63+
64+
Project maintainers who do not follow or enforce the Code of Conduct in good
65+
faith may face temporary or permanent repercussions as determined by other
66+
members of the project's leadership.
67+
68+
## Attribution
69+
70+
This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
71+
available at [http://contributor-covenant.org/version/1/4][version]
72+
73+
[homepage]: http://contributor-covenant.org
74+
[version]: http://contributor-covenant.org/version/1/4/

‎CONTRIBUTING.md

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
2+
# Contributing to codegate
3+
First off, thank you for taking the time to contribute to codegate! :+1: :tada: codegate is released under the Apache 2.0 license. If you would like to contribute something or want to hack on the code, this document should help you get started. You can find some hints for starting development in codegate's [README](https://github.com/stacklok/codegate/blob/main/README.md).
4+
5+
## Table of contents
6+
- [Code of Conduct](#code-of-conduct)
7+
- [Reporting Security Vulnerabilities](#reporting-security-vulnerabilities)
8+
- [How to Contribute](#how-to-contribute)
9+
- [Using GitHub Issues](#using-github-issues)
10+
- [Not sure how to start contributing...](#not-sure-how-to-start-contributing)
11+
- [Pull Request Process](#pull-request-process)
12+
- [Contributing to docs](#contributing-to-docs)
13+
- [Commit Message Guidelines](#commit-message-guidelines)
14+
15+
## Code of Conduct
16+
This project adheres to the [Contributor Covenant](https://github.com/stacklok/codegate/blob/main/CODE_OF_CONDUCT.md) code of conduct. By participating, you are expected to uphold this code. Please report unacceptable behavior to [email protected].
17+
18+
## Reporting Security Vulnerabilities
19+
20+
If you think you have found a security vulnerability in codegate please DO NOT disclose it publicly until we’ve had a chance to fix it. Please don’t report security vulnerabilities using GitHub issues; instead, please follow this [process](https://github.com/stacklok/codegate/blob/main/SECURITY.md)
21+
22+
## How to Contribute
23+
24+
### Using GitHub Issues
25+
We use GitHub issues to track bugs and enhancements. If you have a general usage question, please ask in [CodeGate's discussion forum](https://discord.com/invite/RkzVuTp3WK).
26+
27+
If you are reporting a bug, please help to speed up problem diagnosis by providing as much information as possible. Ideally, that would include a small sample project that reproduces the problem.
28+
29+
### Not sure how to start contributing...
30+
PRs to resolve existing issues are greatly appreciated and issues labeled as ["good first issue"](https://github.com/stacklok/codegate/issues?q=is%3Aopen+is%3Aissue+label%3A%22good+first+issue%22) are a great place to start!
31+
32+
### Pull Request Process
33+
* Create an issue outlining the fix or feature.
34+
* Fork the codegate repository to your own GitHub account and clone it locally.
35+
* Hack on your changes.
36+
* Correctly format your commit messages, see [Commit Message Guidelines](#Commit-Message-Guidelines) below.
37+
* Open a PR by ensuring the title and its description reflect the content of the PR.
38+
* Ensure that CI passes, if it fails, fix the failures.
39+
* Every pull request requires a review from the core CodeGate team before merging.
40+
* Once approved, all of your commits will be squashed into a single commit with your PR title.
41+
42+
### Contributing to docs
43+
Follow [this guide](https://github.com/stacklok/codegate/blob/main/docs/README.md) for instructions on building, running, and previewing codegate's documentation.
44+
45+
### Commit Message Guidelines
46+
We follow the commit formatting recommendations found on [Chris Beams' How to Write a Git Commit Message article](https://chris.beams.io/posts/git-commit/):
47+
48+
1. Separate subject from body with a blank line
49+
1. Limit the subject line to 50 characters
50+
1. Capitalize the subject line
51+
1. Do not end the subject line with a period
52+
1. Use the imperative mood in the subject line
53+
1. Use the body to explain what and why vs. how

‎SECURITY.md

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
# Security Policy
2+
3+
## Reporting a Vulnerability
4+
5+
The CodeGate community take security seriously! We appreciate your efforts to disclose your findings responsibly and will make every effort to acknowledge your contributions.
6+
7+
## Reporting a vulnerability
8+
9+
To report a security issue, please use the GitHub Security Advisory ["Report a Vulnerability"](https://github.com/stacklok/codegate/security/advisories/new) tab.
10+
11+
If you are unable to access GitHub you can also email us at [email protected].
12+
13+
Include steps to reproduce the vulnerability, the vulnerable versions, and any additional files to reproduce the vulnerability.
14+
15+
If you are only comfortable sharing under GPG, please start by sending an email requesting a public PGP key to use for encryption.
16+
17+
### Contacting the CodeGate Security Team
18+
19+
Contact the team by sending email to [email protected].
20+
21+
## Disclosures
22+
23+
### Private Disclosure Processes
24+
25+
The CodeGate community asks that all suspected vulnerabilities be handled in accordance with [Responsible Disclosure model](https://en.wikipedia.org/wiki/Responsible_disclosure).
26+
27+
### Public Disclosure Processes
28+
29+
If anyone knows of a publicly disclosed security vulnerability please IMMEDIATELY email [email protected] to inform us about the vulnerability so that we may start the patch, release, and communication process.
30+
31+
If a reporter contacts the us to express intent to make an issue public before a fix is available, we will request if the issue can be handled via a private disclosure process. If the reporter denies the request, we will move swiftly with the fix and release process.
32+
33+
## Patch, Release, and Public Communication
34+
35+
For each vulnerability, the CodeGate security team will coordinate to create the fix and release, and notify the rest of the community.
36+
37+
All of the timelines below are suggestions and assume a Private Disclosure.
38+
39+
- The security team drives the schedule using their best judgment based on severity, development time, and release work.
40+
- If the security team is dealing with a Public Disclosure all timelines become ASAP.
41+
- If the fix relies on another upstream project's disclosure timeline, that will adjust the process as well.
42+
- We will work with the upstream project to fit their timeline and best protect CodeGate users.
43+
- The Security team will give advance notice to the Private Distributors list before the fix is released.
44+
45+
### Fix Team Organization
46+
47+
These steps should be completed within the first 24 hours of Disclosure.
48+
49+
- The security team will work quickly to identify relevant engineers from the affected projects and packages and being those engineers into the [security advisory](https://docs.github.com/en/code-security/security-advisories/) thread.
50+
- These selected developers become the "Fix Team" (the fix team is often drawn from the projects MAINTAINERS)
51+
52+
### Fix Development Process
53+
54+
These steps should be completed within the 1-7 days of Disclosure.
55+
56+
- Create a new [security advisory](https://docs.github.com/en/code-security/security-advisories/) in affected repository by visiting `https://github.com/stacklok/codegate/security/advisories/new`
57+
- As many details as possible should be entered such as versions affected, CVE (if available yet). As more information is discovered, edit and update the advisory accordingly.
58+
- Use the CVSS calculator to score a severity level.
59+
![CVSS Calculator](/images/calc.png)
60+
- Add collaborators from codeowners team only (outside members can only be added after approval from the security team)
61+
- The reporter may be added to the issue to assist with review, but **only reporters who have contacted the security team using a private channel**.
62+
- Select 'Request CVE'
63+
![Request CVE](/docs/static/img/cve.png)
64+
- The security team / Fix Team create a private temporary fork
65+
![Security Fork](/docs/static/img/fork.png)
66+
- The Fix team performs all work in a 'security advisory' within its temporary fork
67+
- CI can be checked locally using the [act](https://github.com/nektos/act) project
68+
- All communication happens within the security advisory, it is *not* discussed in slack channels or non private issues.
69+
- The Fix Team will notify the security team that work on the fix branch is completed, this can be done by tagging names in the advisory
70+
- The Fix team and the security team will agree on fix release day
71+
- The recommended release time is 4pm UTC on a non-Friday weekday. This means the announcement will be seen morning Pacific, early evening Europe, and late evening Asia.
72+
73+
If the CVSS score is under ~4.0
74+
([a low severity score](https://www.first.org/cvss/specification-document#i5)) or the assessed risk is low the Fix Team can decide to slow the release process down in the face of holidays, developer bandwidth, etc.
75+
76+
Note: CVSS is convenient but imperfect. Ultimately, the security team has discretion on classifying the severity of a vulnerability.
77+
78+
The severity of the bug and related handling decisions must be discussed on in the security advisory, never in public repos.
79+
80+
### Fix Disclosure Process
81+
82+
With the Fix Development underway, the security team needs to come up with an overall communication plan for the wider community. This Disclosure process should begin after the Fix Team has developed a Fix or mitigation so that a realistic timeline can be communicated to users.
83+
84+
**Fix Release Day** (Completed within 1-21 days of Disclosure)
85+
86+
- The Fix Team will approve the related pull requests in the private temporary branch of the security advisory
87+
- The security team will merge the security advisory / temporary fork and its commits into the main branch of the affected repository
88+
![Security Advisory](docs/images/publish.png)
89+
- The security team will ensure all the binaries are built, signed, publicly available, and functional.
90+
- The security team will announce the new releases, the CVE number, severity, and impact, and the location of the binaries to get wide distribution and user action. As much as possible this announcement should be actionable, and include any mitigating steps users can take prior to upgrading to a fixed version. An announcement template is available below. The announcement will be sent to the the following channels:
91+
- A link to fix will be posted to the [Stackloks Discord Server](https://t.co/3sCyFqDNWA) in the CodeGate channels.
92+
93+
## Retrospective
94+
95+
These steps should be completed 1-3 days after the Release Date. The retrospective process [should be blameless](https://landing.google.com/sre/book/chapters/postmortem-culture.html).
96+
97+
- The security team will send a retrospective of the process to the [Stackloks Discord Server](https://t.co/3sCyFqDNWA) including details on everyone involved, the timeline of the process, links to relevant PRs that introduced the issue, if relevant, and any critiques of the response and release process.

0 commit comments

Comments
 (0)