From a5d45ae472b2df71a4569d4a20e99f6245317978 Mon Sep 17 00:00:00 2001 From: Brett Smith Date: Wed, 4 Nov 2026 10:59:06 -0500 Subject: [PATCH 1/2] Remove obsolete documentation for PSRT title tags Managing GHSAs is no longer limited to repository admins so we prefer for people to make changes directly. The bot will no longer act on these tags. --- security/psrt.rst | 27 +++------------------------ 1 file changed, 3 insertions(+), 24 deletions(-) diff --git a/security/psrt.rst b/security/psrt.rst index b338c37f2..520eca7c7 100644 --- a/security/psrt.rst +++ b/security/psrt.rst @@ -148,26 +148,18 @@ vulnerability, or as a security vulnerability. If the Coordinator needs help from core team experts in making the determination, the experts may be added as 'Collaborators' to the GHSA ticket. Accepted security vulnerabilities will be moved to the 'Draft' state in GHSA. -Only repository admins can accept advisories; however, PSRT members may accept -reports through the PSRT bot by prepending ``[ACCEPTED]`` to the GHSA's -title. If the report isn't a vulnerability, coordinators close the GHSA ticket after optionally opening a public GitHub issue. Note that reporters often will not open a GitHub issue on their own, as there is no longer an incentive -for them to do so without a CVE being assigned. Similarly to accepting, -only repository admins can close advisories; however, PSRT members may close -reports through the PSRT bot by prepending ``[CLOSED]`` (for regular bugs), -``[INVALID]`` (for spam), ``[DUPLICATE]`` (for duplicates), or ``[COMPLETED]`` -(for completed tickets where an advisory has been issued) to the GHSA's title. +for them to do so without a CVE being assigned. Remediating a vulnerability report ---------------------------------- Once a report has been accepted as a vulnerability, the remediation development process begins. Coordinators move the GHSA ticket to a 'Draft' -state using the green :guilabel:`Accept as Draft` button (repository admins) -or the PSRT bot's ``[ACCEPTED]`` title tag. Once in this state, +state using the green :guilabel:`Accept as Draft` button. Once in this state, the PSRT bot will automatically assign a CVE ID from the Python Software Foundation CVE Numbering Authority and create a temporary private fork. @@ -288,9 +280,6 @@ if applying the patch isn't the only way to mitigate the vulnerability. to releasing. After an advisory email is sent, the GHSA ticket can be closed. -As only repository admins can close advisories directly, PSRT members -can prepend ``[COMPLETED]`` to the GHSA's title and the PSRT bot -will close the ticket. .. _advisory template: #advisory-email @@ -300,23 +289,13 @@ The PSRT bot ------------ The :github:`PSRT bot ` is a GitHub App -that automates parts of the GHSA workflow described above. GitHub only -allows repository admins to modify security advisories, so the bot enables -any PSRT member to move a report through the process using title tags. - +that automates parts of the GHSA workflow described above. The bot runs hourly (or by manual dispatch) and for each open GHSA ticket: * Adds the PSRT GitHub team as collaborators, giving members access to new reports. -* Moves tickets from the 'Triage' to the 'Draft' state when the title contains - the ``[ACCEPTED]`` tag. -* Closes tickets when the title contains one of the closing tags - (``[CLOSED]``, ``[INVALID]``, ``[DUPLICATE]``, or ``[COMPLETED]``). * For accepted ('Draft') tickets, creates the temporary private fork if one doesn't already exist, and reserves a CVE ID. -Tags are case-insensitive and can appear anywhere in the title, though for visibility -they are prepended. - Handling code signing certificate reports ----------------------------------------- From f18844584d1948b68b7a8b34daa58dbb3a11eaf8 Mon Sep 17 00:00:00 2001 From: Brett Smith Date: Wed, 4 Nov 2026 11:12:21 -0500 Subject: [PATCH 2/2] Document more maintenance the PSRT bot does --- security/psrt.rst | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/security/psrt.rst b/security/psrt.rst index 520eca7c7..60e9c8039 100644 --- a/security/psrt.rst +++ b/security/psrt.rst @@ -293,8 +293,12 @@ that automates parts of the GHSA workflow described above. The bot runs hourly (or by manual dispatch) and for each open GHSA ticket: * Adds the PSRT GitHub team as collaborators, giving members access to new reports. -* For accepted ('Draft') tickets, creates the temporary private fork if one +* For newly accepted ('Draft') tickets, creates the temporary private fork if one doesn't already exist, and reserves a CVE ID. +* Adds people who contribute to or review the private fork's pull requests to + the GHSA credits. +* For other accepted ('Draft') tickets, if the associated CVE has been published + with a patch, closes the ticket as resolved. Handling code signing certificate reports -----------------------------------------