[Building Sakai] Sakai process for Security Contributions

[Neal Caidin]

[sakai-dev, sakai-pmc, sakai-security, sakai-security contacts]

Hi All,

We have a nice, well defined process for standard patch contributions [1].

We have also been discussing a process to allow for Sakai security
contributions, on the Sakai Security list, and on the Security WG team
call, and on the Sakai core team call [2]. It seems like we have consensus
but thought I would send it more broadly to see if there are any additional
comments or concerns, and to encourage contributions!

*Sakai Security patch contribution process*


   1. Open a Security JIRA.
   2. Unlike a typical patch that would go directly into a PR (pull
   request), the patch will be attached to the JIRA for review.
   3. After patch is approved , a core committer will commit it directly to
   Sakai trunk (example below). When pushed, Git will have an entry for the
   author, as specified explicitly above, and the committer, whoever pushes in
   the patch.

git commit --author="Joe Smith <joe.smith at genericinstitution.edu>"

I'll give this until Wednesday, March 11 for comment. After which I will
integrate the overall security information and link to it from our Github
repo [3].

[1] Standard Git process for Sakai contributions -
https://confluence.sakaiproject.org/display/SAKDEV/Git+Setup

[2] Git process for Sakai security contributions -
https://confluence.sakaiproject.org/pages/viewpage.action?pageId=99483813

[3] Sakai Github repo - https://github.com/sakaiproject/sakai

Thanks,
Neal Caidin
Sakai Community Coordinator
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://collab.sakaiproject.org/pipermail/sakai-dev/attachments/20150305/765aaac4/attachment.html