add SECURITY_CONTACTS to repo template

[jessfraz]

This adds a list of contacts for the repo that the Product Security Team can
reach out to for triaging and handling of incoming issues, please try to keep
this list small as the contact can then further decide who "needs to know" to
complete the fix.

[jessfraz]

cc @tallclair @philips @cjcullen @liggitt

[cblecker]

cc: @cjwagner @BenTheElder @fejta @spiffxp (for comment on the OWNERS file spec itself)

@jessfraz: are you looking to have any automation consume this, or is this primarily for humans on the PST to use?

/area security test-infra

[jessfraz]

I believe humans for the time being but maybe we will make a small tool for us :)

…

On Fri, Apr 20, 2018 at 1:20 PM, Christoph Blecker ***@***.*** > wrote: cc: @cjwagner <https://github.com/cjwagner> @BenTheElder <https://github.com/BenTheElder> @fejta <https://github.com/fejta> @spiffxp <https://github.com/spiffxp> (for comment on the OWNERS file spec itself) @jessfraz <https://github.com/jessfraz>: are you looking to have any automation consume this, or is this primarily for humans on the PST to use? /area security test-infra — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#2062 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABYNbAXESV2FZP1Fn0u8TLJh6V2CIw6-ks5tqkL2gaJpZM4TeB0r> .

-- Jessie Frazelle 4096R / D4C4 DD60 0D66 F65A 8EFC 511E 18F3 685C 0022 BFF3 pgp.mit.edu <http://pgp.mit.edu/pks/lookup?op=get&search=0x18F3685C0022BFF3>

[BenTheElder]

I will let @cjwagner confirm but I believe the existing tooling will only inspect known fields. Makes sense for this to be in OWNERS to me :-)

[idvoretskyi]

/hold

for the discussion keep going

[tallclair]

It's usually easy enough to track someone down via their github handle, but not always (email hidden, different slack handle). Do we want to require contact information here?

[jessfraz]

oh good point we probably only want emails, but then idk if people want their email in a repo...

[cblecker]

We have had privacy/legal issues previously around putting personal information (such as e-mail addresses) inside repos. You need explicit consent from anyone who you do this for. Not impossible, but can be difficult to enforce and audit.

[liggitt]

IIRC, there were issues with requiring personal info about people be published on github

[cjwagner]

kubernetes/test-infra#3271 (comment)

[liggitt]

see also #1808 (comment) for rationalizing how OWNERS files map to repos/sigs/subprojects... we probably wouldn't want this field populated in deeply nested folders or at multiple levels

[jessfraz]

true we only need it in the root, is there a way to designate that or should i just add to the definition?

[liggitt]

is there a way to designate that or should i just add to the definition?

no formal way I know of, probably just a comment

[cjwagner]

Why does this belong in the OWNERS files? It seems like it should not for a few reasons:

• OWNERS files are scoped to files/directories and can apply recursively and cumulatively to directories beneath them. This list of contacts is simply scoped at the repo level.
• Existing OWNERS file automation wouldn't be applicable to this field because it is only allowed to be specified at root.
• It doesn't sound like this field would require any related automation.

I think putting this information in something like a SECURITY_CONTACTS (or a more general CONTACTS) file at the repo root would serve the same function without conflating the function of OWNERS files.

[cblecker]

Putting it in OWNERS may allow for future parsing, and I can also see some use cases where you'd want nested information.. mono repos like k/k would probably have multiple levels of security contacts, where as most repos would only need this at the root.

[tpepper]

The role description (and the guidance to put in root of the sig’s repos?) should also be added to https://github.com/kubernetes/community/blob/master/committee-steering/governance/sig-governance-template-short.md

[cblecker]

@cjwagner It sounds like though, that there are no technical issues with adding this. The existing automation will ignore it, correct?

If so, then I'd pose the question back to the PST: Is there a future intention of using the OWNERS system/automation with these contacts, or will it for the foreseeable future just be a human contact list? If there are future intentions of using the OWNERS system (such as prow plugins/tools), then I'm supportive of expanding the specification. If there is no intention of using any of that logic in the future, then perhaps a separate file that the PST controls the spec of is better. I'm okay letting you folks decide.

[jessfraz]

I mean it might be nice to have automation in the future but as of right now I was just going to maybe make us a tool to do the lookups and translate to an email.

[cblecker]

Then I'd say, working under the assumption that this will not break any existing automation/tooling, my opinion would be that we expand the spec to include security contacts. There is already code available to parse the OWNERS file if we use github handles (https://git.k8s.io/test-infra/prow/plugins/approve/approvers), and within the project people know where to go to the OWNERS file to look for things.

[cjwagner]

@cblecker Yeah, it shouldn't break anything.

[jessfraz]

sorry for the delay...

opened kubernetes/kubernetes-template-project#18

and updated here

[cblecker]

/lgtm
/assign @spiffxp @philips

This works for me. Assigning to Aaron/Brandon for approval.

[wking]

Do you want backticks instead of brackets here? Althernatively, could you add a reference like this (which currently 404s, but that's a separate issue)? If you add the reference, you'll want a SECURITY_CONTACTS in this repo (probably not a bad idea anyway).

[jessfraz]

I don't really think the community repo qualifies as it has no code other than scripts, but the repo owners are more than welcome to add one

…

On Sun, May 20, 2018 at 9:34 AM W. Trevor King ***@***.***> wrote: ***@***.**** commented on this pull request. ------------------------------ In committee-steering/governance/sig-governance-template-short.md <#2062 (comment)>: > @@ -50,6 +50,13 @@ Membership for roles tracked in: <link to OWNERS file> - *MAY* participate in decision making for the subprojects they hold roles in - Includes all reviewers and approvers in [OWNERS] files for subprojects +- Security Contact + - *MUST* be a contact point for the Product Security Team to reach out to for + triaging and handling of incoming issues + - *MUST* accept the [Embargo Policy](https://github.com/kubernetes/sig-release/blob/master/security-release-process-documentation/security-release-process.md#embargo-policy) + - Defined in [SECURITY_CONTACTS] files, this is only relevant to the root file in Do you want backticks instead of brackets here? Althernatively, could you add a reference like this <https://github.com/kubernetes/community/blame/0a614ded6f114487dd78b5cec4329d19df8711d4/committee-steering/governance/sig-governance-template-short.md#L137> (which currently 404s, but that's a separate issue)? If you add the reference, you'll want a SECURITY_CONTACTS in this repo (probably not a bad idea anyway). — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#2062 (review)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABYNbNzWKAdYaXxPOB4WQp_IdYmdK-cYks5t0ZsPgaJpZM4TeB0r> .

-- Jessie Frazelle 4096R / D4C4 DD60 0D66 F65A 8EFC 511E 18F3 685C 0022 BFF3 pgp.mit.edu <http://pgp.mit.edu/pks/lookup?op=get&search=0x18F3685C0022BFF3>

[jessfraz]

Also the line above with OWNERS has brackets I merely copied the formatting

…

On Sun, May 20, 2018 at 5:32 PM Jessie Frazelle ***@***.***> wrote: I don't really think the community repo qualifies as it has no code other than scripts On Sun, May 20, 2018 at 9:34 AM W. Trevor King ***@***.***> wrote: > ***@***.**** commented on this pull request. > ------------------------------ > > In committee-steering/governance/sig-governance-template-short.md > <#2062 (comment)> > : > > > @@ -50,6 +50,13 @@ Membership for roles tracked in: <link to OWNERS file> > - *MAY* participate in decision making for the subprojects they hold roles in > - Includes all reviewers and approvers in [OWNERS] files for subprojects > > +- Security Contact > + - *MUST* be a contact point for the Product Security Team to reach out to for > + triaging and handling of incoming issues > + - *MUST* accept the [Embargo Policy](https://github.com/kubernetes/sig-release/blob/master/security-release-process-documentation/security-release-process.md#embargo-policy) > + - Defined in [SECURITY_CONTACTS] files, this is only relevant to the root file in > > Do you want backticks instead of brackets here? Althernatively, could you > add a reference like this > <https://github.com/kubernetes/community/blame/0a614ded6f114487dd78b5cec4329d19df8711d4/committee-steering/governance/sig-governance-template-short.md#L137> > (which currently 404s, but that's a separate issue)? If you add the > reference, you'll want a SECURITY_CONTACTS in this repo (probably not a > bad idea anyway). > > — > You are receiving this because you were mentioned. > Reply to this email directly, view it on GitHub > <#2062 (review)>, > or mute the thread > <https://github.com/notifications/unsubscribe-auth/ABYNbNzWKAdYaXxPOB4WQp_IdYmdK-cYks5t0ZsPgaJpZM4TeB0r> > . > -- Jessie Frazelle 4096R / D4C4 DD60 0D66 F65A 8EFC 511E 18F3 685C 0022 BFF3 pgp.mit.edu <http://pgp.mit.edu/pks/lookup?op=get&search=0x18F3685C0022BFF3>

-- Jessie Frazelle 4096R / D4C4 DD60 0D66 F65A 8EFC 511E 18F3 685C 0022 BFF3 pgp.mit.edu <http://pgp.mit.edu/pks/lookup?op=get&search=0x18F3685C0022BFF3>

[wking]

Also the line above with OWNERS has brackets I merely copied the formatting

Look at the formatted rendering, which currently shows a link for OWNERS and a bracketed [SECURITY_CONTACTS]. The difference is the reference definition for OWNERS, which allows GitHub's renderer to interpret [OWNERS] an implicit reference-style link. Without a local SECURITY_CONTACTS to link, I think you'll just want to replace the SECURITY_CONTACTS brackets with backticks.

[wking]

Do you want to define the syntax here (one GitHub username per line, with blank lines and # comments ignored)? Or just link to the template once kubernetes/kubernetes-template-project#18 lands and assume the sytax is self-evident? Without at least one of those, examples in the wild may not be consistent enough for machine parsing.

[jessfraz]

will do

[jessfraz]

this should be all good now and inline with kubernetes/kubernetes-template-project#18

[cblecker]

@philips Would you mind reviewing this and kubernetes/kubernetes-template-project#18 as @spiffxp is out?

[cblecker]

kubernetes/kubernetes-template-project#18 has merged

/lgtm
/approve
/hold cancel

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cblecker

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• committee-steering/OWNERS [cblecker]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment