Re: [PATCH v3] embargoed releases: also describe the git-security list and the process

[Junio C Hamano <gitster@pobox.com>]

Julia Ramer <prplr@github.com> writes:

>> > +- Once the review has settled and everyone involved in the review agrees that
>> > +  the patches are ready, the Git maintainer, and others determine a release date
>> > +  as well as the release trains that are serviced. The decision regarding which
>>
>> We typically know how involved the final changes would be (i.e. the
>> minimum time it would take for us and involved others to prepare the
>> release) way before all the t's are crossed and i's are dotted in
>> the patches, so setting the release date may be done much earlier.
>
> Distilled into s/ready/nearing the finish line/

Excellent.

>> > +- Less than a week before the release, a mail with the relevant information is
>> > +  sent to <distros@vs.openwall.org> (see below), a list used to pre-announce
>> > +  embargoed releases of open source projects to the stakeholders of all major
>> > +  distributions of Linux as well as other OSes. This includes a Git bundle
>> > +  of the tagged version(s), but no further specifics of the vulnerability.
> ...
> I think it makes sense to just remove the entire last sentence, as the
> relevant information is referenced in the parenthetical "(see below)".

Very sensible.

Thanks.