Suggest port maintainers submit bugs for VuXML updates.

[pauamma_gundo.com]

Summary

While there, add a missing word nearby.

Test Plan

make all

Eyeball lynx output

[pauamma_gundo.com]

Anything I should do to move this along?

[carlavilla]

Added ports team

[grahamperrin]

Side note: in a different chapter (out of scope for this review) there is, again, misuse of the phrase Security Officer Team.

https://docs.freebsd.org/en/books/porters-handbook/book/#makefile-maintainer

documentation/content/en/books/porters-handbook/security/_index.adoc

101–102

The order of words is strange (for example, as early after a security vulnerability is discovered as possible).

Also, re: discovery, port users should be notified only if a vulnerability is already publicly disclosed.

108–109

Security Officer is not a team.

Also, conciseness.

110–111

Security Officer is not a team.

111

Do you mean, a bug report with a summary line something like what's below?

security/vuxml: create an entry for category/portname

111–113

Security Officer is not a team.

[grahamperrin]

If a bug report involves a publicly-disclosed vulnerability for which there's not yet a VuXML entry, then the report should have:

• ports-secteam@ amongst CC recipients
• keyword security
• flag merge-quarterly set to ?
• priority maximised, to Normal
• severity maximised, to Affects Many People.

---

Also: why do we encourage addressing the Security Team, or Security Officer, without mentioning the (more relevant) Ports Security Team?

[pauamma_gundo.com]

Good questions all. Waiting for a ports secteam member to address them so I can revise this usefully.

[pauamma_gundo.com]

In D37094#866667, @pauamma wrote:

Good questions all. Waiting for a ports secteam member to address them so I can revise this usefully.

ping ports secteam

[riggs]

In D37094#882796, @pauamma wrote:

In D37094#866667, @pauamma wrote:

Good questions all. Waiting for a ports secteam member to address them so I can revise this usefully.

ping ports secteam

Will take a look, thanks for the reminder.

[riggs]

documentation/content/en/books/porters-handbook/security/_index.adoc

108–109

Generally, here and all the other places in the doc: I'd mention both the Security Team (#t-secteam) and Ports Security Team(#t-ports-secteam). Our vuxml page (https://vuxml.freebsd.org/freebsd/index.html) contains both base system and ports vulnerabilities.
While the project admin page says that the Security Team is looking after src and ports, it also says the Ports Security Team is focused on ports, hence it will look after security/vuxml in the ports tree (and is the official maintainer of this port as per security/vuxml/Makefile).
So I'd contact ports-secteam@ first when there is something about security/vuxml that needs to be resolved.

[pauamma_gundo.com]

Updated patch to follow after it finishes building and I look it over.

documentation/content/en/books/porters-handbook/security/_index.adoc

101–102

Agreed to both, but out of scope.

108–109

Do you mean mention both where either is mentioned? Otherwise there's only here, unless I missed something.

111

Yes.

[pauamma_gundo.com]

• Address edit comments by riggs and grahamperrin