[golang] restrict access to golang issues #11663
Conversation
|
rolandshoemaker is a new contributor to projects/golang. The PR must be approved by known contributors before it can be merged. The past contributors are: catenacyber |
There was a problem hiding this comment.
Can you confirm @AdamKorcz shouldn't be on the list? He was added to provide support for golang fuzzing (done a lot https://github.com/google/oss-fuzz/commits/master/projects/golang) a couple of years ago #5617 and I assume in order to keep this maintained and perhaps expanded it's good to keep @AdamKorcz on the list -- I think he may have submitted some of the reports you mention?
view_restrictions will do such that Monorail issues will no longer be public when issues are found. It was set to this from the start of this integration: #2188 (comment)
|
I'm not strictly opposed to leaving Adam on the list, with the understanding that we wish to restrict these issues because we believe they may have security impact per the Go Security policy and should not be disclosed publicly until we've decided they do not and/or are fixed. If they are okay with informal handshake agreement as such I can put them back in. |
I am more than happy to stay on the list. |
For reference, all projects on OSS-Fuzz are subject to https://google.github.io/oss-fuzz/getting-started/bug-disclosure-guidelines/ |
We've had multiple security reports originating from crashes discovered by oss-fuzz. I was unaware that the results were entirely public. Restrict access to issues to the Go Security team.
|
👍 updated. |
|
Build is failing but is not due to this PR |
|
#11665 should fix the build. |
3 participants
We've had multiple security reports originating from crashes discovered by oss-fuzz. I was unaware that the results were entirely public.
Restrict access to issues to the Go Security team.
Note: It's unclear to me if this actually accomplishes what I want.
view_restrictionsseems entirely undocumented. From contextual clues from other projects it seems that removing the field causes restriction, but that is entirely a guess.