From 98b7384e085c1f067cdfd76d5f45adcace3dc9f4 Mon Sep 17 00:00:00 2001 From: "Schu, Markus" Date: Tue, 30 Jun 2026 18:20:44 +0200 Subject: [PATCH 1/3] add security.md --- SECURITY.md | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000000..2e219a374a5 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,37 @@ +# Security Policy + +This Eclipse Foundation Project adheres to the [Eclipse Foundation Vulnerability Reporting Policy](https://www.eclipse.org/security/policy/). + +## How To Report a Vulnerability + +If you think you have found a vulnerability in this repository, please report it to us through coordinated disclosure. + +**Please do not report security vulnerabilities through public issues, discussions, or change requests.** + +Instead, report it using one of the following ways: + +* Create a [confidential issue](https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/new?issuable_template=new_vulnerability) in the Eclipse Foundation Vulnerability Reporting Tracker +* Report a [vulnerability](https://github.com/eclipse-score/score/security/advisories/new) directly via private vulnerability reporting on GitHub + +You can find more information about reporting and disclosure at the [Eclipse Foundation Security page](https://www.eclipse.org/security/) or +the {need}`Platform Vulnerability Management Plan`. + +Please include as much of the information listed below as you can to help us better understand and resolve the issue: + +* The type of issue (e.g., buffer overflow, SQL injection, or cross-site scripting) +* Affected version(s) +* Impact of the issue, including how an attacker might exploit the issue +* Step-by-step instructions to reproduce the issue +* The location of the affected source code (tag/branch/commit or direct URL) +* Full paths of source file(s) related to the manifestation of the issue +* Configuration required to reproduce the issue +* Log files that are related to this issue (if possible) +* Proof-of-concept or exploit code (if possible) + +This information will help us triage your report more quickly. + +## Supported Versions + +Supported versions are: + +* Version 0.8 From dc6ae836e27a597c8a36e757e92efe10637eddd9 Mon Sep 17 00:00:00 2001 From: "Schu, Markus" Date: Wed, 12 Aug 2026 16:36:42 +0000 Subject: [PATCH 2/3] change codeownership for score_tools to safety manager --- .github/CODEOWNERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 3c0079f9b76..ee837d410ed 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -49,7 +49,7 @@ verification/ @eclipse-score/automotive-score-committers /docs/safety/ @aschemmel-tech @masc2023 @PandaeDo # /docs/score_releases/ @eclipse-score/automotive-score-project-leads /docs/score_releases/ @thilo-schmitt @HartmannNico @antonkri @FScholPer @qor-lb @johannes-esr @anmittag -/docs/score_tools/ @eclipse-score/automotive-score-committers +/docs/score_tools/ @masc2023 @aschemmel-tech @PandaeDo # /docs/security/ @eclipse-score/security-managers /docs/security/ @masc2023 @PandaeDo # /docs/verification_report @eclipse-score/automotive-score-technical-leads From 8196664eb4b3decbea13ff80e5963ea82fba1f15 Mon Sep 17 00:00:00 2001 From: "Schu, Markus" Date: Sat, 17 Oct 2026 07:40:10 +0200 Subject: [PATCH 3/3] fix review findings --- SECURITY.md | 37 ------------------- .../change_management.rst | 25 +++++++++++++ 2 files changed, 25 insertions(+), 37 deletions(-) delete mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md deleted file mode 100644 index 2e219a374a5..00000000000 --- a/SECURITY.md +++ /dev/null @@ -1,37 +0,0 @@ -# Security Policy - -This Eclipse Foundation Project adheres to the [Eclipse Foundation Vulnerability Reporting Policy](https://www.eclipse.org/security/policy/). - -## How To Report a Vulnerability - -If you think you have found a vulnerability in this repository, please report it to us through coordinated disclosure. - -**Please do not report security vulnerabilities through public issues, discussions, or change requests.** - -Instead, report it using one of the following ways: - -* Create a [confidential issue](https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/new?issuable_template=new_vulnerability) in the Eclipse Foundation Vulnerability Reporting Tracker -* Report a [vulnerability](https://github.com/eclipse-score/score/security/advisories/new) directly via private vulnerability reporting on GitHub - -You can find more information about reporting and disclosure at the [Eclipse Foundation Security page](https://www.eclipse.org/security/) or -the {need}`Platform Vulnerability Management Plan`. - -Please include as much of the information listed below as you can to help us better understand and resolve the issue: - -* The type of issue (e.g., buffer overflow, SQL injection, or cross-site scripting) -* Affected version(s) -* Impact of the issue, including how an attacker might exploit the issue -* Step-by-step instructions to reproduce the issue -* The location of the affected source code (tag/branch/commit or direct URL) -* Full paths of source file(s) related to the manifestation of the issue -* Configuration required to reproduce the issue -* Log files that are related to this issue (if possible) -* Proof-of-concept or exploit code (if possible) - -This information will help us triage your report more quickly. - -## Supported Versions - -Supported versions are: - -* Version 0.8 diff --git a/docs/platform_management_plan/change_management.rst b/docs/platform_management_plan/change_management.rst index e52463670bd..c419cb648b4 100644 --- a/docs/platform_management_plan/change_management.rst +++ b/docs/platform_management_plan/change_management.rst @@ -49,6 +49,17 @@ Change Management Goals * Changes Requests are tracked until closure and and communicated to affected parties. * Change Requests and affected work products are bidirectionally traced. +Change Management Scope +^^^^^^^^^^^^^^^^^^^^^^^^ + +Change management applies to the work products and configuration items identified in the +:need:`Configuration Management Plan `. + +Change management applies to these work products and items for their complete lifecycle, +as defined in :need:`doc__config_mgt_plan` ("Lifecycle"). This is independent of the +Expected Implementation Version/Milestone of an individual Change Request +(:need:`gd_req__change_attr_milestone`), which only states the deadline for that request. + Approach ++++++++ @@ -88,6 +99,11 @@ Therefore the Change Template :need:`gd_temp__change_feature_request` or In addition :need:`Impact Analysis Template ` should be used, if applicable. +The template covers the affected element, its interfaces and connected elements, the change +type, work products affected versus those requiring modification, parties and +responsibilities for distributed development, safety impact, and the +implementation/verification schedule. + .. note:: Parts of the template are automatically included in the ISSUE **Change Request**. Use ISSUE **Change Request** to request a change in **S-CORE**. @@ -263,6 +279,11 @@ state, the state in the Projects dashboard view and the PR status. Description and Impact analysis part of the ISSUE. Further detailed analysis results are part of the linked PR, provided as part of the feature/request templates. +The request date is the ISSUE creation date, recorded automatically by the Issue Tracking +System. The starting release version is the main branch state (or applicable baseline) +at the time the Change Request is created, identifiable via the base commit of the linked PR; +this is distinct from the Expected Implementation Version, which identifies the target release. + Further information about detailed implementation can be provided in the Realize part of the ISSUE. :need:`[[title]] `, @@ -283,6 +304,10 @@ linked PR or other ISSUEs. :need:`[[title]] ` is provided in the Expected Implementation Version part of the ISSUE. Optionally the Milestone part of the ISSUE can be set. +For an accepted Change Request, who implements it is recorded via the Assignees part of the +ISSUE and/or the assignees of linked implementation PRs/Issues, considering the interfaces +involved. + .. _change_mgmt_workflow: