1# Security release process 2 3The security release process covers the steps required to plan/implement a 4security release. This document is copied into the description of the Next 5Security Release and used to track progress on the release. It contains ***TEXT 6LIKE THIS*** which will be replaced during the release process with the 7information described. 8 9## Planning 10 11* [ ] Open an [issue](https://github.com/nodejs-private/node-private) titled 12 `Next Security Release`, and put this checklist in the description. 13 14* [ ] Get agreement on the list of vulnerabilities to be addressed: 15 * ***H1 REPORT LINK***: ***DESCRIPTION*** (***CVE or H1 CVE request link***) 16 * v10.x, v12.x: ***LINK to PR URL*** 17 * ... 18 19* [ ] PR release announcements in [private](https://github.com/nodejs-private/nodejs.org-private): 20 * (Use previous PRs as templates. Don't forget to update the site banner and 21 the date in the slug so that it will move to the top of the blog list.) 22 * [ ] pre-release: ***LINK TO PR*** 23 * [ ] post-release: ***LINK TO PR*** 24 25* [ ] Get agreement on the planned date for the release: ***RELEASE DATE*** 26 27* [ ] Get release team volunteers for all affected lines: 28 * v12.x: ***NAME of RELEASER(S)*** 29 * ... other lines, if multiple releasers 30 31## Announcement (one week in advance of the planned release) 32 33* [ ] Check that all vulnerabilities are ready for release integration: 34 * PRs against all affected release lines or cherry-pick clean 35 * Approved 36 * Pass `make test` 37 * Have CVEs 38 * Described in the pre/post announcements 39 40* [ ] Pre-release announcement [email][]: ***LINK TO EMAIL*** 41 (Get access from existing manager: Ben Noordhuis, Rod Vagg, Michael Dawson) 42 43* [ ] Pre-release announcement to nodejs.org blog: ***LINK TO BLOG*** 44 (Re-PR the pre-approved branch from nodejs-private/nodejs.org-private to 45 nodejs/nodejs.org) 46 47* [ ] Post in the #nodejs-social channel in the OpenJS Foundation Slack 48 asking that the social team tweet/retweet the pre-announcement. 49 If you are on Twitter, you can just direct message the `@nodejs` handle. 50 51* [ ] Request releaser(s) to start integrating the PRs to be released. 52 53* [ ] Notify [docker-node][] of upcoming security release date: ***LINK*** 54 55* [ ] Notify build-wg of upcoming security release date by opening an issue 56 in [nodejs/build][] to request WG members are available to fix any CI issues. 57 58## Release day 59 60* [ ] [Lock CI](https://github.com/nodejs/build/blob/master/doc/jenkins-guide.md#before-the-release) 61 62* [ ] The releaser(s) run the release process to completion. 63 64* [ ] [Unlock CI](https://github.com/nodejs/build/blob/master/doc/jenkins-guide.md#after-the-release) 65 66* [ ] Post-release announcement in reply [email][]: ***LINK TO EMAIL*** 67 68* [ ] Post-release announcement to Nodejs.org blog: ***LINK TO BLOG POST*** 69 * (Re-PR the pre-approved branch from nodejs-private/nodejs.org-private to 70 nodejs/nodejs.org) 71 72* [ ] Post in the #nodejs-social channel in the OpenJS Foundation Slack 73 asking that the social team tweet/retweet the announcement. 74 If you are on Twitter, you can just direct message the `@nodejs` handle. 75 76* [ ] Comment in [docker-node][] issue that release is ready for integration. 77 The docker-node team will build and release docker image updates. 78 79* [ ] For every H1 report resolved: 80 * Close as Resolved 81 * Request Disclosure 82 * Request publication of [H1 CVE requests][] 83 * (Check that the "Version Fixed" field in the CVE is correct, and provide 84 links to the release blogs in the "Public Reference" section) 85 86* [ ] PR machine-readable JSON descriptions of the vulnerabilities to the 87 [core](https://github.com/nodejs/security-wg/tree/master/vuln/core) 88 vulnerability DB. ***LINK TO PR*** 89 90* [ ] Close this issue 91 92* [ ] Make sure the PRs for the vulnerabilities are closed. 93 94[H1 CVE requests]: https://hackerone.com/nodejs/cve_requests 95[docker-node]: https://github.com/nodejs/docker-node/issues 96[email]: https://groups.google.com/forum/#!forum/nodejs-sec 97[nodejs/build]: https://github.com/nodejs/build/issues 98