Provide https://qubes-os.org/.well-known/security.txt

[DemiMarie]

How to file a helpful issue

The problem you're addressing (if any)

Qubes OS doesn’t support the [security.txt] standard for machine-parsable vulnerability reporting information.

The solution you'd like

Support the standard :slightly_smiling_face:

The value to a user, and who that user might be

Not sure tbh.

[andrewdavidwong]

What should the content of this file consist of? How common is this? Do other projects do it?

[unman]

On Thu, Oct 28, 2021 at 06:28:39PM -0700, Andrew David Wong wrote:

What should content of this file consist of? How common is this? Do other projects do it?

https://securitytxt.org/ It's becoming more common although still not (imo) widely adopted.

[andrewdavidwong]

https://securitytxt.org/ It's becoming more common although still not (imo) widely adopted.

Thanks. I generated one:

Contact: https://www.qubes-os.org/security/
Expires: 2025-01-01T08:00:00.000Z
Encryption: https://keys.qubes-os.org/keys/qubes-os-security-team-key.asc
Canonical: https://qubes-os.org/.well-known/security.txt
Policy: https://www.qubes-os.org/security/

(Not sure if Jekyll/GH Pages will let us use /.well-known/ in the permalink, but if not, we can put it in the root directory.)

@DemiMarie, is this what you had in mind?

[DemiMarie]

@andrewdavidwong For contact I would use mailto:[email protected] unless there is some reason not to.

[SaswatPadhi]

@andrewdavidwong:

Not sure if Jekyll/GH Pages will let us use /.well-known/ in the permalink, but if not, we can put it in the root directory.

If you place .well-known at the root of repo and add:

include:
  - .well-known

to the _config.yml file, then Jekyll will include this directory at the root of the output directory and the permalink /.well-known/ should work.

[andrewdavidwong]

@andrewdavidwong For contact I would use mailto:[email protected] unless there is some reason not to.

I don't want it to get any more spam.

@andrewdavidwong:

Not sure if Jekyll/GH Pages will let us use /.well-known/ in the permalink, but if not, we can put it in the root directory.

If you place .well-known at the root of repo and add:

include:
  - .well-known

to the _config.yml file, then Jekyll will include this directory at the root of the output directory and the permalink /.well-known/ should work.

Thanks!

[alimirjamali]

pr submitted: https://github.com/QubesOS/qubesos.github.io/pull/247 Awaits review

@parulin for the next time, add one of the keywords mentioned here to commit message to link it to issue. Thanks.