← Back to issue list

docs: add security policy

View original Github issue

Metadata

Project
charmcraft
Number
#2237
Type
pull request
State
merged
Author
tigarmo
Labels
—
Created
Updated
Closed

Current evaluation

PR #2237 merged as commit e699fd97, adding SECURITY.md covering charm vs Charmcraft responsibility, LXD/Multipass build isolation, destructive builds, base/Ubuntu LTS support cycle, and private vulnerability reporting.

Resolution: closed resolved

Reason: The documentation PR itself was merged into main as commit e699fd97, creating SECURITY.md (+61 lines). Follow-ups #2240 (c7f258db) refined the charm definition and #2406 (be3bf003) switched links to the ubuntu.com domain.

Evaluated by: mr-cal-bot

No scores available.

Issue body

The policy distinguishes between Charmcraft itself and the charms it generates, describes the technologies used in build isolation and the how Charmcraft base support is related to Ubuntu's.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved PR #2237 merged as commit e699fd97, adding SECURITY.md covering charm vs Charmcraft responsibility, LXD/Multipass build isolation, destructive builds, base/Ubuntu LTS support cycle, and private vulnerability reporting.
stealth/space-bunny-alpha — closed resolved Merged PR #2237 (commit e699fd97) added SECURITY.md with Charmcraft's security policy, later refined by followup PR #2240 (c7f258db) and a docs domain update (#2406).
stealth/space-bunny-alpha — closed resolved Merged PR #2237 in commit e699fd97, adding a security policy distinguishing Charmcraft from generated charms and documenting build isolation and Ubuntu base support.
qwen/qwen3.6-35b-a3b — — Merged documentation update adding a security policy. The policy distinguishes Charmcraft from generated charms, outlines build isolation technologies, and clarifies base support alignment with Ubuntu. Approved by two reviewers.
qwen3.6-35b-a3b-mtp-q6 — — Added security policy documentation detailing distinctions between Charmcraft and generated charms, build isolation technologies, and Ubuntu base support alignment. Merged by maintainer tigarmo.

Update history

No update history recorded yet.

Related work

  • Likely Fixed By: canonical/charmcraft#2240 (confidence 90%)

    Follow-up docs PR adjusting the charm definition wording in SECURITY.md (commit c7f258db).

  • Related To: canonical/charmcraft#2406 (confidence 75%)

    Later commit be3bf003 switched SECURITY.md links to the ubuntu.com domain.

Related issues

Issue Project State Summary Similarity
#5324 docs: add security policy snapcraft merged Merged PR #5324 in commit 7a164a2bc, adding SECURITY.md with vulnerability reporting, supported-release, and base/Ubuntu LTS guidance.
82%
#80 docs: add security policy craft-grammar merged Merged PR #80 in commit 869adcc, adding a 34-line SECURITY.md covering supported versions and private vulnerability reporting.
80%
#329 docs: add security policy craft-cli merged Merged: PR #329 by bepri added SECURITY.md to craft-cli documenting supported release cycle and Canonical private vulnerability reporting; landed as commit 561c533 (CRAFT-4301), approved with 2 reviewers.
79%
#671 docs: add security policy craft-application merged PR #671 merged (commit 251a48a3), adding SECURITY.md to craft-application ported from Starbase's policy. Documents supported versions and directs reports to GitHub private advisories; advisories tab still pending with Canonical security team.
78%
#110 docs: add security policy craft-platforms merged Merged #110 in commit 64b8ae2, adding SECURITY.md with supported-version guidance and private vulnerability-reporting instructions (CRAFT-4281).
78%
#372 docs: add security policy fetch-service merged Merged PR #372 (commit 38d65fb, "docs: add security policy") adding a 32-line SECURITY.md to fetch-service, documenting what counts as a vulnerability, supported versions, and private reporting via GitHub security advisories.
78%
#154 docs: add security policy craft-archives merged PR #154 by bepri added a 34-line SECURITY.md (release cycle scope plus private security report/embargo guidance) for CRAFT-4299; approved by two reviewers and merged as commit 015bbe5.
77%
#730 docs: add security policy craft-providers merged Merged PR #730 (commit dc8ff23) added SECURITY.md to craft-providers, documenting supported release cycle and how to file a private security report; resolves CRAFT-4780.
77%
#837 docs: add security policy rockcraft merged Merged PR #837 (commit 0f44e504) added a real SECURITY.md for rockcraft, replacing the GitHub template (#356/#365) with a policy covering rock authorship, build isolation, supported bases and vulnerability reporting via private security reports.
76%
#63 Add initial SECURITY.md policy imagecraft merged Merged PR #63 (commit 2148066) by upils added Imagecraft's first SECURITY.md: responsibility split between image authors and LXD/Multipass for build isolation, latest-release-only support, and GitHub private security reports.
76%