From 4f0416968bb7d559facfc7b743788c00ee8c7981 Mon Sep 17 00:00:00 2001 From: Ferruh Yigit Date: Mon, 17 Jun 2019 17:06:47 +0100 Subject: [PATCH] doc: clarify security pre-release end of embargo date Clarify that a fixed date will be used for end of embargo (public disclosure) date while communicating with downstream stakeholders. Initial document got a review that it gives an impression that communicated embargo date can be a range like 'less than a week' which is not the case. The range applies when defining the end of the embargo date but a fix date will be communicated. Signed-off-by: Ferruh Yigit Acked-by: John McNamara --- doc/guides/contributing/vulnerability.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/guides/contributing/vulnerability.rst b/doc/guides/contributing/vulnerability.rst index da00acd4f0..746231402c 100644 --- a/doc/guides/contributing/vulnerability.rst +++ b/doc/guides/contributing/vulnerability.rst @@ -182,7 +182,7 @@ When the fix is ready, the security advisory and patches are sent to downstream stakeholders (`security-prerelease@dpdk.org `_), specifying the date and time of the end of the embargo. -The public disclosure should happen in **less than one week**. +The communicated public disclosure date should be **less than one week** Downstream stakeholders are expected not to deploy or disclose patches until the embargo is passed, otherwise they will be removed from the list. -- 2.20.1