Re: [qemu-web PATCH v2 3/3] contribute: switch security process to gitlab confidential issues

["Daniel P. Berrangé" <berrange@redhat.com>]

On Thu, Jun 18, 2026 at 11:30:29AM -0400, Michael S. Tsirkin wrote:
> > + * The maintainer(s) will develop and/or review patch(es)
> > +   for the issue privately, optionally attaching work in
> > +   progress fixes to the GitLab issues.
> 
> attaching how? how do i ask reported to test the fix?
> was easy in the email flow.

You can add arbitrary attachments in gitlab issue comments.

> > All patches must
> > +   include the issue URL in the commit message(s).
> 
> you mean the commit message of the patches I presume?
> there's no commit at that point.

Well I presume the maintainer will have a local git tree
with a work-in-progress commit.

> > The
> > +   **"Workflow::In Progress"** label should be assigned when
> > +   a maintainer starts working on a fix.
> 
> That's a bit heavy, and what is "working" anyway.
> It's an issue tracker not a planning app.
> Don't try to make it one.

Various "Workflow::" labels are already present in our gitlab
instance. We don't use them consistently - this text is just
a pointer that the're there.



> 
> 
> > + * When a CVE is allocated, it must be recorded as a comment on
> > +   the GitLab issue, and the **"CVE::Required"** label replaced by
> > +   the **"CVE::Assigned"** label.
> 
> Recorded as a comment how exactly, in what format?

In plain text.

> 
> > + * The maintainer(s) will update the commit message(s)
> 
> what does it mean to "update the commit message"?

The commit message for the patch the maintainer has in their
tree.


> > to include
> > +   the assigned CVE and issue URL. If multiple commits are required
> > +   to fix an issue the CVE must be included in the final commit in
> > +   the series, and may optionally be included in all prior commits.
> 
> And here, included in what format?

The CVE just needs to exist somewhere/anywhere in the commit message.
It is common to put it in the first line, or with tags before SoB
but it doesn't really matter as long as we have a record of it in
the patch.

With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|