Roller Security

<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements.  See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License.  You may obtain a copy of the License at

    https://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->

Apache Roller security response

Use this workflow for vulnerability response, not ordinary bug fixes. The PMC owns acceptance, severity, release scope, and disclosure decisions. This skill supports those decisions; loading it does not authorize messages or publication. Parts are designed to work with Obsidian (the triage-<year> directory is a vault), but Obsidian is optional.

Confidentiality and project practice

Keep reports, reproductions, CVE reservations, reporter identities, investigation notes, and disclosure schedules in a private workspace. If using triage-<year>/ in a checkout, verify its local Git exclusion before adding case material. Exclusion prevents accidental additions; it is not access control and does not remove material from Git history. Never force-add private records.

Roller uses public code review for fixes. Follow the PMC's agreed workflow and keep vulnerability characterization out of branch names, commits, PR text, tests, and comments until disclosure. Neutral wording alone does not prove that a diff is safe: review what the entire change reveals, including related cases. Resolve uncertainty with the PMC and ASF Security. Do not assume that derivability from public source makes an unannounced finding appropriate for publication.

When public text such as a release announcement, blog post or website page is prepared before disclosure, by a person or another agent, give the author the permitted facts and the constraints on scope and tone. Do not tell them what is being withheld or why: the instruction itself must be safe to leak. Keep such text neutral until the advisories are out.

Keep only generic procedures and synthetic templates in this skill. Do not add live portal screenshots, case-derived examples, or release execution notes.

Read the case before acting

1. Locate the private workspace and read its summary and the item's TRACKING.md.
2. Read the original report, reproduction evidence and IMPLEMENTATION.md.
3. Check the implementation branch, review state and release target against the actual repository. Do not infer that a message was sent from a draft file, or that none was received because the record lacks one; search the correspondence before stating what a reporter said or did not say.
4. Reconcile CVE_FORM.md before using the portal or drafting an advisory.

For new cases, copy assets/item-template/ into a private item directory. TRACKING.md frontmatter stores facts; checkboxes store workflow state. The terminal board reads those files directly:

python3 skills/roller-security/scripts/triage-status.py "$TRIAGE_DIR"

Set TRIAGE_DIR to the actual private workspace. Commands above run from the Roller checkout root; when installed elsewhere, resolve scripts relative to this skill. Plain Markdown editing works; Obsidian Tasks is optional. Read tracking conventions when creating or migrating records. Keep completion dates and mark irrelevant tasks explicitly.