Repository navigation
Add SECURITY.md and a reproducible build environment - #1606
Merged
petersmythe merged 1 commit intoOct 26, 2026
Merged
petersmythe merged 1 commit into
petersmythe merged 1 commit into
Conversation
GeoWebCache has no security policy of its own. SECURITY.md is based on GeoServer's and points at the shared geoserver-security list and at GitHub private reporting. build/.oss-scanner/Dockerfile builds every module with -Dall as linux.yml does, runs the full unit test suite and leaves the Maven repository populated so the project can be built and tested offline (mvn -o). It also adds geowebcache-start, which runs the standalone webapp on port 8081. It also installs zizmor, an analyser for GitHub Actions workflows, from its published wheel after checking the SHA-256. build/.oss-scanner/threat_model.md describes where untrusted input enters, which components and CI workflows matter most, how findings are rated and what to leave alone. It also sets a reporting threshold so findings reach the security list in stages: Critical only from 2026-10-25, High from 2026-11-02, Medium from 2026-11-09 and everything from 2026-11-16. An Override line holds the threshold back, and the file explains how.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GeoWebCache has no security policy of its own. This adds a SECURITY.md based on GeoServer's, pointing at the shared geoserver-security list and at GitHub private reporting, which is already enabled on this repository.
It also adds build/.oss-scanner/Dockerfile and build/.oss-scanner/threat_model.md.
The Dockerfile builds every module with -Dall as linux.yml does, runs the full unit test suite, and leaves the Maven repository populated so the project can be built and tested again offline (mvn -o). It also adds geowebcache-start, which runs the standalone webapp on port 8081 for manual testing. It also installs zizmor, an analyser for GitHub Actions workflows, from its published wheel after checking the SHA-256, so the workflows can be analysed offline.
The threat model describes where untrusted input enters, which components and CI workflows matter most, how findings are rated, and what to leave alone. It also has a reporting threshold, so that findings reach the security list in stages, most severe first, instead of all at once: Critical only from 2026-10-25, then High from 2026-11-02, Medium from 2026-11-09 and everything from 2026-11-16. A single
Override:line holds the threshold back if reports pile up, and the file explains how to change it.Before merging, the PSC should check that the SECURITY.md text is what we want and that build/.oss-scanner/ is the right place for these files - chosen to align with the existing GeoTools and GeoServer build directories.