Copilot commented on code in PR #149: URL: https://github.com/apache/cloudstack-go/pull/149#discussion_r3568401829
########## SECURITY.md: ########## @@ -0,0 +1,35 @@ +<!-- +SPDX-License-Identifier: Apache-2.0 + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +--> Review Comment: The license header here is not the standard ASF header used throughout this repository (it’s the generic Apache 2.0 boilerplate and it omits the usual “Licensed to the ASF under one or more contributor license agreements … NOTICE file …” preamble). For consistency (and to match the PR description’s claim of a full ASF header), consider switching to the same ASF header format used in other files in this repo. ########## SECURITY.md: ########## @@ -0,0 +1,35 @@ +<!-- +SPDX-License-Identifier: Apache-2.0 + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +--> + +# Security Policy + +## Reporting a Vulnerability + +`apache/cloudstack-go` follows the [Apache Software Foundation security process](https://www.apache.org/security/). +Please report suspected vulnerabilities privately to `[email protected]`; do not +open public GitHub issues or pull requests for security reports. + +## Threat Model + +`apache/cloudstack-go` is part of the Apache CloudStack project and is covered by the +**project-wide CloudStack threat model** rather than a per-repository copy. What the +project treats as in scope and out of scope, the security properties it provides and +disclaims, the adversary model, and how findings are triaged are documented in that +model: <https://github.com/apache/cloudstack/blob/main/THREAT_MODEL.md>. + +(That link resolves once the project-wide model lands on `apache/cloudstack`'s +`main` branch — see apache/cloudstack#13293. A thin `cloudstack-go`-specific +addendum can be added here later if this component needs one.) Review Comment: The threat-model link currently points to `apache/cloudstack/blob/main/THREAT_MODEL.md`, but that file does not exist on `apache/cloudstack`’s `main` branch right now, and the referenced `apache/cloudstack#13293` PR is closed. As written, readers/scanners will hit a 404; consider adding a working fallback link (e.g., the PR/discussion) and softening the claim that it “resolves once … lands”. ########## AGENTS.md: ########## @@ -0,0 +1,13 @@ +<!-- SPDX-License-Identifier: Apache-2.0 --> + Review Comment: This repo consistently uses the standard multi-line ASF license header in tracked files (e.g., Go sources and GitHub workflows). Using only a one-line SPDX tag here is inconsistent, and it’s also the reason this file is being added to `.rat-excludes`. Consider using the standard ASF header (optionally including SPDX inside it) so the file can be scanned normally by RAT. ########## .rat-excludes: ########## @@ -3,3 +3,8 @@ go.mod go.sum rat-report.txt apache-rat-0.17 + +# Security-model scaffold (carries an SPDX header; exempted +# from RAT for setups that don't scan Markdown headers). +AGENTS.md +SECURITY.md Review Comment: Excluding `AGENTS.md` and `SECURITY.md` from RAT means future license-header regressions in these files won’t be caught by CI (this repo runs Apache RAT in `.github/workflows/rat.yaml`). If you switch these files to the standard ASF header format, you should be able to remove these exclusions and keep policy docs covered by the RAT check. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
