[PATCH] doc: use single GPG key for security team

[PATCH] doc: use single GPG key for security team

[Stephen Hemminger]

Reports should be encrypted to the shared key published
for security@dpdk.org, not to individual team members.
Document the fingerprint and how to fetch it via WKD.

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
 doc/guides/contributing/vulnerability.rst | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/doc/guides/contributing/vulnerability.rst b/doc/guides/contributing/vulnerability.rst
index 9a0684df22..d07662d51e 100644
--- a/doc/guides/contributing/vulnerability.rst
+++ b/doc/guides/contributing/vulnerability.rst
@@ -41,6 +41,17 @@ This address is open to all,
 but access to its inbox is intentionally limited to a small group
 to minimize the risk of early disclosure.
 
+Encrypt the report to the DPDK security team key for security@dpdk.org,
+with fingerprint::
+
+  912D 9514 04F5 D8CE 36C7  A338 7305 BE09 7E37 712D
+
+The key is published through WKD and can be retrieved with::
+
+  gpg --locate-external-keys security@dpdk.org
+
+Check the fingerprint above before using the key.
+
 GPG-sign any one-on-one correspondence related to the vulnerability report
 as part of maintaining a secure communication process.
 
-- 
2.53.0