Review Fedora security documents to align with "Vulnerability and Incident Policy" CRA requirement #14

Open
opened 2026-07-09 17:38:31 +00:00 by rzhukov · 8 comments
Member

As mentioned here council/tickets#559 we (as a community) would like to work together on the CRA and overall Security improvement roadmap for Fedora. We at Red Hat recently released a CRA and Security Playbook largely based on the good and known community practices (e.g, OpenSSF).

One of the items - Cybersecurity, Vulnerability Management and Incident Response Policy. It can be 1 document, it can be series of the documents, but should contain (at minimum) the basic required info.

What we were able to find so far which is relevant to "Security Policy" somehow:

The ask:
Review these (and possibly other related security documents) against these requirements and adjust where needed.

Next step (will create another ticket) will be to adopt security.md file.

As mentioned here https://forge.fedoraproject.org/council/tickets/issues/559 we (as a community) would like to work together on the CRA and overall Security improvement roadmap for Fedora. We at Red Hat recently released a [CRA and Security Playbook](https://access.redhat.com/security/eu-cyber-resilience-act-stewardship-guidelines#:~:text=CRA%20legal%20requirements.-,Item,-Description) largely based on the good and known community practices (e.g, OpenSSF). One of the items - [Cybersecurity, Vulnerability Management and Incident Response Policy](https://access.redhat.com/security/eu-cyber-resilience-act-stewardship-guidelines#:~:text=Cybersecurity%2C%20Vulnerability%20Management%20and%20Incident%20Response%20Policy). It can be 1 document, it can be series of the documents, but should contain (at minimum) the basic required info. What we were able to find so far which is relevant to "Security Policy" somehow: - For infra apps and services there is skeletal sec. Policy for app development https://docs.fedoraproject.org/en-US/infra/developer_guide/security_policy/ - For the distribution content, it’s the responsibility of the maintainer https://docs.fedoraproject.org/en-US/package-maintainers/Package_Update_Guide/#security_updates and https://docs.fedoraproject.org/en-US/fesco/Package_maintainer_responsibilities/#_manage_security_issues - Also general Fedora Updates policy https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ - This exists but is meant as guidance for all open source developers, not really a Fedora policy https://docs.fedoraproject.org/en-US/defensive-coding/ - Software bundling policy https://docs.fedoraproject.org/en-US/fesco/Bundled_Software_policy/ (“This provides a mechanism for locating libraries with bundled code which can, for example, assist in locating packages which may have particular security vulnerabilities.”) **The ask**: Review these (and possibly other related security documents) against [these requirements](https://access.redhat.com/security/eu-cyber-resilience-act-stewardship-guidelines#:~:text=Cybersecurity%2C%20Vulnerability%20Management%20and%20Incident%20Response%20Policy) and adjust where needed. Next step (will create another ticket) will be to [adopt security.md file](https://forge.stg.fedoraproject.org/Rainbows-and-Unicorns/issue_creation_test/src/branch/main/security.md).
Owner

The teams that maintain these repositories/Docs are:

  • infra
  • fesco
  • packager (-> although this particular section might overlap with our SIG, not only in terms of people working on this)
  • Docs (-> defensive coding; though my feeling is that this could be unmaintained and disappear when pagure is put offline; Petr might know about it)
The teams that maintain these repositories/Docs are: * infra * fesco * packager (-> although this particular section might overlap with our SIG, not only in terms of people working on this) * Docs (-> defensive coding; though my feeling is that this could be unmaintained and disappear when pagure is put offline; Petr might know about it)
Member

Skimming through the points on that stewardship list, I think this is the state of play for Fedora.

Reporting Actively Exploited Vulnerabilities and Severe Incidents to national CSIRTs and ENISA

This is something we'd need to collaborate with Red Hat to write a process for.

Cybersecurity, Vulnerability Management and Incident Response Policy

I think the docs you've linked are the closest things we have today. Writing proper policies has been discussed (security/docs#6 & security/docs#7) but no one has actually done it yet.

SBOMs

Not yet but I think https://fedoraproject.org/wiki/Changes/Adopt_PURL_Metadata will make it much easier to adopt SBOMs.

Security Self-Assesment

Not something we do today but I'm sure one could be written as part of the policy.

Contributing Guidance

This is the remit of the Join SIG (https://docs.fedoraproject.org/en-US/fedora-join/) who have lots of documentation for new contributors, and operate things like the Mentorship scheme and Outreachy (https://docs.fedoraproject.org/en-US/mentored-projects/).

Release Documentation

Individual packages have changelogs in their RPM metadata (rpm -q --changelog <packagename>). A changelog for the distribution as a whole is maintained on https://fedoraproject.org/wiki/Changes.

Defect Reporting Guide

Needs to be written (security/docs#7).

MFA Enforcement

As of recently, MFA is enforced for provenpackagers (users who can commit to any repo) fesco/tickets#3618. Discussions are ongoing about applying it to the entire contributor base fesco/tickets#3625.

Branch Protection

I think most individual components maintained by the Fedora team (e.g. things on https://github.com/fedora-infra) use Branch Protection. dist-git repositories (https://src.fedoraproject.org) does not currently use branch protection. When this has been suggested in the past, concerns have been raised about the overhead it'll add to many single-maintainer packages.

License File

The entire Fedora project is covered by the MIT license (https://docs.fedoraproject.org/en-US/legal/fedora-linux-license/). Some components may also have a LICENSE.md in their repos.

OSPS

This one is new to me but I think we already meet a lot of the controls https://baseline.openssf.org/versions/2026-02-19. We'll need a tracker for checking them more precisely.

SLSA

I'd need to do some closer reading, but I think the way we use Koji as a hosted build platform and do artifact signing (https://docs.fedoraproject.org/en-US/security/cryptography/signatures/) aligns with SLSA Level 2. Maybe Level 3 but I'm not certain from a quick look.

OpenSSF Best Practices Badge

Requirements for this all look pretty doable https://www.bestpractices.dev/en/criteria/0. We should start a separate tracker for collecting answers but I'm happy to blitz through most of them.

Signing Commits

Individual contributors may decide to sign their commits, but enforcing it is blocked behind forge/forge#446

Skimming through the points on that stewardship list, I think this is the state of play for Fedora. > Reporting Actively Exploited Vulnerabilities and Severe Incidents to national CSIRTs and ENISA This is something we'd need to collaborate with Red Hat to write a process for. > Cybersecurity, Vulnerability Management and Incident Response Policy I think the docs you've linked are the closest things we have today. Writing proper policies has been discussed (https://forge.fedoraproject.org/security/docs/issues/6 & https://forge.fedoraproject.org/security/docs/issues/7) but no one has actually done it yet. > SBOMs Not yet but I think <https://fedoraproject.org/wiki/Changes/Adopt_PURL_Metadata> will make it much easier to adopt SBOMs. > Security Self-Assesment Not something we do today but I'm sure one could be written as part of the policy. > Contributing Guidance This is the remit of the Join SIG (<https://docs.fedoraproject.org/en-US/fedora-join/>) who have lots of documentation for new contributors, and operate things like the Mentorship scheme and Outreachy (<https://docs.fedoraproject.org/en-US/mentored-projects/>). > Release Documentation Individual packages have changelogs in their RPM metadata (`rpm -q --changelog <packagename>`). A changelog for the distribution as a whole is maintained on <https://fedoraproject.org/wiki/Changes>. > Defect Reporting Guide Needs to be written (https://forge.fedoraproject.org/security/docs/issues/7). > MFA Enforcement As of recently, MFA is enforced for `provenpackagers` (users who can commit to any repo) https://forge.fedoraproject.org/fesco/tickets/issues/3618. Discussions are ongoing about applying it to the entire contributor base https://forge.fedoraproject.org/fesco/tickets/issues/3625. > Branch Protection I think most individual components maintained by the Fedora team (e.g. things on <https://github.com/fedora-infra>) use Branch Protection. dist-git repositories (<https://src.fedoraproject.org>) does not currently use branch protection. When this has been suggested in the past, concerns have been raised about the overhead it'll add to many single-maintainer packages. > License File The entire Fedora project is covered by the MIT license (<https://docs.fedoraproject.org/en-US/legal/fedora-linux-license/>). Some components may also have a `LICENSE.md` in their repos. > OSPS This one is new to me but I think we already meet a lot of the controls <https://baseline.openssf.org/versions/2026-02-19>. We'll need a tracker for checking them more precisely. > SLSA I'd need to do some closer reading, but I think the way we use Koji as a hosted build platform and do artifact signing (<https://docs.fedoraproject.org/en-US/security/cryptography/signatures/>) aligns with SLSA Level 2. _Maybe_ Level 3 but I'm not certain from a quick look. > OpenSSF Best Practices Badge Requirements for this all look pretty doable <https://www.bestpractices.dev/en/criteria/0>. We should start a separate tracker for collecting answers but I'm happy to blitz through most of them. > Signing Commits Individual contributors may decide to sign their commits, but enforcing it is blocked behind https://forge.fedoraproject.org/forge/forge/issues/446
Author
Member

Thanks for the comprehensive analysis! I created this issue to have closer look into the policy docs + discuss security.md file adoptions (and use cases when it doesn't make sense, for instance). But @thebeanogamer got the full reqs assessment, bravo! I'd suggest let's continue conversation how to approach it all step by step on the next SIG meeting

Thanks for the comprehensive analysis! I created this issue to have closer look into the policy docs + discuss security.md file adoptions (and use cases when it doesn't make sense, for instance). But @thebeanogamer got the full reqs assessment, bravo! I'd suggest let's continue conversation how to approach it all step by step on the next SIG meeting

Is there a security policy for container images produced by Fedora?

Handling of security updates for packages works. But as soon as these packages are published as a container image the policies and best practices do not seem to apply anymore. It is unclear who built an image, images do not get updated, EOL images do not get unpublished.

See https://forge.fedoraproject.org/docs/tickets/issues/19.

Is there a security policy for container images produced by Fedora? Handling of security updates for packages works. But as soon as these packages are published as a container image the policies and best practices do not seem to apply anymore. It is unclear who built an image, images do not get updated, EOL images do not get unpublished. See [https://forge.fedoraproject.org/docs/tickets/issues/19](https://forge.fedoraproject.org/docs/tickets/issues/19).
Member

@tk2345 wrote in #14 (comment):

Is there a security policy for container images produced by Fedora?

Handling of security updates for packages works. But as soon as these packages are published as a container image the policies and best practices do not seem to apply anymore. It is unclear who built an image, images do not get updated, EOL images do not get unpublished.

See docs/tickets#19.

There's a broader audit going on there as part of #6. There's a very different toolchain between the base container images and everything else, which we need to try and standardise.

@tk2345 wrote in https://forge.fedoraproject.org/security/tickets/issues/14#issuecomment-1062687: > Is there a security policy for container images produced by Fedora? > > Handling of security updates for packages works. But as soon as these packages are published as a container image the policies and best practices do not seem to apply anymore. It is unclear who built an image, images do not get updated, EOL images do not get unpublished. > > See https://forge.fedoraproject.org/docs/tickets/issues/19. There's a broader audit going on there as part of #6. There's a very different toolchain between the base container images and everything else, which we need to try and standardise.
Owner

Related #19

Related https://forge.fedoraproject.org/security/tickets/issues/19
Owner

I remove the meeting label for now, assuming there is nothing to discuss at this particular ticket at the moment but rather at its split follow-up tickets (?), but feel free to add the label again!

I remove the meeting label for now, assuming there is nothing to discuss at this particular ticket at the moment but rather at its split follow-up tickets (?), but feel free to add the label again!
Member

Created security/docs#19 to publish the security.md

Created https://forge.fedoraproject.org/security/docs/pulls/19 to publish the security.md
Sign in to join this conversation.
No labels
meeting
No milestone
No project
No assignees
4 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
security/tickets#14
No description provided.