[PATCH v2 09/18] security-manual/vulnerabilities.rst: require Upstream-Status, not recommend

Antonin Godard
2026-04-24T08:28:59Z

We want the Upstream-Status in any case, even if the status turns to be
something like "oe-specific". So explicitly require it here.

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
---
documentation/security-manual/vulnerabilities.rst | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/documentation/security-manual/vulnerabilities.rst b/documentation/security-manual/vulnerabilities.rst
index 983e1548c..6121d4d7d 100644
--- a/documentation/security-manual/vulnerabilities.rst
+++ b/documentation/security-manual/vulnerabilities.rst
@@ -234,7 +234,7 @@ the format::

CVE: CVE-2022-3341

-It is also recommended to add the ``Upstream-Status:`` tag with a link
+It is also required to add the ``Upstream-Status:`` tag with a link
to the original patch and sign-off by people working on the backport.
If there are any modifications to the original patch, note them in
the ``Comments:`` tag.

--
2.53.0