* docs: switch security reporting to GitHub private vulnerability reporting
Replace the cncf-harbor-security mailing list with GitHub private
vulnerability reporting as the intake channel for security reports,
per goharbor/community#292. Private vulnerability reporting is enabled
on the repository.
- SECURITY.md: point reporters at the Security tab / Report a
vulnerability form; describe the advisory-based triage, CVSS,
in-band CVE request, and temporary private fork workflow; keep the
mailing list only as a fallback for reporters without a GitHub
account and for distributor list membership requests
- Add issue template contact link routing vulnerability reports to
the private advisory form
- Add a security warning to the bug report template
Signed-off-by: Vadim Bauer <vb@container-registry.com>
* docs: make GitHub private reporting the sole intake channel
Address review feedback: drop the mailing-list fallback so there is a
single reporting method, clarify that the reporter can see their own
report, and fix template grammar.
Signed-off-by: Vadim Bauer <vb@container-registry.com>
* docs: address review feedback on security reporting switch
- Relax the response SLA: acknowledge within 5 business days, then
investigate and follow up, instead of promising a full investigation
plan within 3 business days.
- Request a CVE from GitHub only where GitHub is eligible as CNA; when
another CNA already covers the affected component, coordinate with
that CNA instead of filing a duplicate.
- Point README.md's vulnerability reporting section at private
vulnerability reporting instead of the security mailing list.
- List cncf-harbor-security@lists.cncf.io again under Mailing lists,
scoped to distributors-list administration, since the Embargo Policy
and membership sections still reference it.
- Split the reporting paragraph, state the GitHub-account requirement as
a deliberate single-channel decision, and stop overloading
'acknowledged' to mean both receipt and triage verdict.
- Disable blank issues so reports cannot bypass the issue chooser and
its security contact link.
- Note that larger artifacts are shared in the temporary private fork;
the advisory form is not documented to accept attachments.
Signed-off-by: Vadim Bauer <vb@container-registry.com>
* docs: drop Notary from the dependency example list
Notary is no longer part of Harbor, so listing it as an example
dependency in the vulnerability-scope section is misleading. Also
normalises PGSql to PostgreSQL in the same list.
Signed-off-by: Vadim Bauer <vb@container-registry.com>
* docs: drop the Notary feature bullet from README
Notary is no longer part of Harbor, so advertising Docker Content Trust
signing via Notary in the feature list is misleading.
Signed-off-by: Vadim Bauer <vb@container-registry.com>
---------
Signed-off-by: Vadim Bauer <vb@container-registry.com>
* remove chart api from swagger
Delete the api path for chart in the swagger
Signed-off-by: Wang Yan <wangyan@vmware.com>
* Remove chart APIs
1. Remove some chart-related steps for Dockerfile for portal container
2. Remove chart APIs for API center
Signed-off-by: AllForNothing <sshijun@vmware.com>
---------
Signed-off-by: Wang Yan <wangyan@vmware.com>
Signed-off-by: AllForNothing <sshijun@vmware.com>
Co-authored-by: Wang Yan <wangyan@vmware.com>
* README.md: fix links to badges
the links to badges are still referring to "master" branch instead of "main". this commit fixes it.
* README.md: fix Restful API links to swagger editor
The links to swagger editor had the URL paths to the master branch which has hence been renamed. This leads to swagger editor failing to open the API links. this commit fixes that.
I cloned the repo, clicked a link to the build guideline in
`CONTRIBUTING.md` and copied the "Build, install and bring up Harbor
without Notary" command:
make install GOBUILDIMAGE=golang:1.12.5 COMPILETAG=compile_golangimage
Being unfamiliar with the Harbor project, I didn't realize that said
command was for building version 2.0.0 and that I had cloned a newer,
incompatible version (2.3.0), so I just ran it and was met by errors:
[…]
# github.com/goharbor/harbor/src/lib/errors
../lib/errors/errors.go:26:7: undefined: errors.As
../lib/errors/errors.go:28:7: undefined: errors.Is
note: module requires Go 1.15
# github.com/hashicorp/go-multierror
[…]
make: *** [Makefile:369: compile_core] Error 2
It took me a while to figure out what the problem was; then I replaced
`2.0.0` with `latest` in the URL and found this command instead:
make install GOBUILDIMAGE=golang:1.13.8 COMPILETAG=compile_golangimage
_Et voilà_ – it worked!
I figured `latest` (which currently redirects to 2.2.0) would make the
most sense for end users and `edge` (which doesn't redirect) for
contributors.
Signed-off-by: Simon Alling <alling.simon@gmail.com>
1, add a specrate git action for conformance test
2, use the OCI testing code to test Harbor master code on push
Signed-off-by: wang yan <wangyan@vmware.com>
- create API folder
- move harbor API swagger file to API/harbor
- add scanner adapter open API swagger file to API/scanner
- update protal build Dockerfile
- update swagger explorer build command in Makefile
Signed-off-by: Steven Zou <szou@vmware.com>
