Add security-model discoverability pointer to the project-wide CloudStack threat model by potiuk · Pull Request #149 · apache/cloudstack-go

potiuk · 2026-05-30T00:13:50Z

Summary

Apache CloudStack's security model is project-wide, not per-repository. This PR replaces the earlier standalone draft-THREAT-MODEL.md in this repo with the standard discoverability chain so automated scanners find the one canonical model:

AGENTS.md → SECURITY.md → the project-wide model at
https://github.com/apache/cloudstack/blob/main/THREAT_MODEL.md

The model lives in apache/cloudstack (see apache/cloudstack#13293); this repo inherits it via the pointer above rather than duplicating it — per the PMC's direction on #13293 to converge on the parent model first. The link resolves once that model lands on main. A thin repo-specific addendum can be added here later if this component needs one.

AGENTS.md carries a one-line SPDX header (it is read by agents on every session); SECURITY.md carries the full ASF header.

yadvr · 2026-06-01T07:19:52Z

There's a lot of details in the draft that needs a better set of eyes, so assigning @DaanHoogland @vishesh92 who're also PMC leads on the work.

DaanHoogland · 2026-06-02T07:34:09Z

Thanks @yadvr, I think we should start with this one and work from there. I’ll look at the fields we need today cc @vishesh92 @potiuk

DaanHoogland · 2026-06-02T12:10:22Z

Thanks @yadvr, I think we should start with this one and work from there. I’ll look at the fields we need today cc @vishesh92 @potiuk

Given that this “inherits” from cloudstack, i think (on second thought) we should start there.

potiuk · 2026-06-02T18:43:44Z

Agreed @DaanHoogland — let's converge on the parent apache/cloudstack model (#13293) first; cloudstack-go then inherits via a discoverability pointer + a thin Go-SDK addendum rather than a full copy. I'll re-point this PR once the parent's shape is settled. Continuing on #13293.

potiuk · 2026-06-02T19:26:47Z

Note on the failing Apache RAT Check — it's the workflow's RAT-download step, not this PR. The job fetches apache-rat-0.17-bin.tar.gz from downloads.apache.org/creadur/…, which now returns a ~196-byte error page instead of the tarball (RAT 0.17 has rolled off the live mirror to archive.apache.org), so tar -xzf fails with gzip: stdin: not in gzip format before RAT ever runs. This PR only adds AGENTS.md + SECURITY.md (both carry license headers), so there's nothing RAT-relevant in the change itself. The same step is failing on the other cloudstack-* satellite PRs. Pointing the download at archive.apache.org/dist/creadur/… (or bumping to a version still on the live mirror) restores it — happy to open that workflow fix separately if useful.

potiuk · 2026-06-04T22:39:21Z

Note for reviewers: the failing Apache RAT Check isn't related to this PR's content. The workflow downloads apache-rat-0.17 from downloads.apache.org, but 0.17 has aged off that mirror, so the download returns an error page instead of the tarball (gzip: stdin: not in gzip format). #150 fixes it by repointing the download to archive.apache.org; once that merges, this check greens. This PR only adds discoverability pointer files.

potiuk · 2026-06-05T02:56:33Z

Thanks @DaanHoogland. This PR was re-pointed to the project-wide CloudStack model (apache/cloudstack#13293) — the per-repo draft-THREAT-MODEL.md your comments were on is replaced by AGENTS.md + SECURITY.md pointers to that canonical model, so these threads are now outdated. Your scope points (the SDK is a CloudStack concern only insofar as it's the Apache-delivered SDK against a targeted-version response; the out-of-scope items) are captured in #13293. Resolving here; the substantive review lives on #13293. (The CI red is the apache-rat download infra, fixed by #150.) Thanks!

Adds a draft project-level security threat-model document (draft-THREAT-MODEL.md) at repo root, improving discoverability for automated security scanners running against this repository. The file follows the rubric format used by several other ASF projects piloting security-model discoverability. The "draft-" prefix signals this is a proposal for the PMC to review, correct, or reject — not a finalised maintainer-blessed model. Every claim carries a provenance tag (documented / inferred / maintainer) so reviewers can see where each claim originates; §14 collects open questions for the maintainers. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…po copy Drop the standalone draft-THREAT-MODEL.md and wire the discoverability chain AGENTS.md -> SECURITY.md -> the project-wide model in apache/cloudstack (apache/cloudstack#13293), so scanners find one canonical model and this repo inherits it rather than duplicating it. Generated-by: Claude Code

These scaffold files carry an SPDX license header, but this repo's Apache RAT check doesn't scan headers embedded in Markdown, so list them in .rat-excludes. Generated-by: Claude Code

potiuk · 2026-06-17T03:04:27Z

Update: rebased onto current main to pick up #139 (Apache RAT 0.17 -> 0.18). The earlier "Apache RAT Check" failure was just the old workflow downloading RAT 0.17, which has aged off downloads.apache.org — RAT and the builds are green now. Ready for review whenever convenient.

Copilot

Pull request overview

This PR adds repository-level security discoverability documents so automated tools can find CloudStack’s canonical, project-wide threat model via a pointer chain (AGENTS.md → SECURITY.md → apache/cloudstack’s THREAT_MODEL.md).

Changes:

Adds SECURITY.md describing vulnerability reporting guidance and linking to the project-wide threat model.
Adds AGENTS.md as an agent-facing entry point pointing scanners/tools to SECURITY.md.
Updates .rat-excludes to exempt the new Markdown files from Apache RAT checks.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
SECURITY.md	Introduces security policy + threat model pointer (with license header).
AGENTS.md	Adds an agent-readable entry point directing tools to `SECURITY.md`.
.rat-excludes	Exempts the new Markdown policy files from RAT scanning.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+<!--
+SPDX-License-Identifier: Apache-2.0
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->


+
+# Security-model scaffold (carries an SPDX header; exempted
+# from RAT for setups that don't scan Markdown headers).
+AGENTS.md
+SECURITY.md


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

+<!--
+SPDX-License-Identifier: Apache-2.0
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->


+(That link resolves once the project-wide model lands on `apache/cloudstack`'s
+`main` branch — see apache/cloudstack#13293. A thin `cloudstack-go`-specific
+addendum can be added here later if this component needs one.)


+<!-- SPDX-License-Identifier: Apache-2.0 -->
+


+
+# Security-model scaffold (carries an SPDX header; exempted
+# from RAT for setups that don't scan Markdown headers).
+AGENTS.md
+SECURITY.md


potiuk force-pushed the asf-security/draft-threat-model-2026-05-30 branch from 0f8d4ea to b6579f6Compare May 30, 2026 18:47

yadvr requested review from DaanHoogland and vishesh92 June 1, 2026 07:17

DaanHoogland reviewed Jun 2, 2026
View reviewed changes

Comment threaddraft-THREAT-MODEL.md Outdated

DaanHoogland reviewed Jun 2, 2026
View reviewed changes

Comment threaddraft-THREAT-MODEL.md Outdated

DaanHoogland reviewed Jun 2, 2026
View reviewed changes

Comment threaddraft-THREAT-MODEL.md Outdated

potiuk changed the title ~~Add draft project security threat-model document~~Add security-model discoverability pointer to the project-wide CloudStack threat modelJun 2, 2026

potiukand others added 3 commits June 16, 2026 22:29

Exclude SECURITY.md + AGENTS.md from RAT
2c92488
These scaffold files carry an SPDX license header, but this repo's Apache RAT check doesn't scan headers embedded in Markdown, so list them in .rat-excludes. Generated-by: Claude Code

potiuk force-pushed the asf-security/draft-threat-model-2026-05-30 branch from c8db4b0 to 2c92488Compare June 17, 2026 02:29

DaanHoogland requested a review from Copilot July 13, 2026 06:01

Copilotstarted reviewing on behalf of DaanHoogland July 13, 2026 06:01 View session

CopilotAI reviewed Jul 13, 2026
View reviewed changes

Potential fix for pull request finding
dff0fe9
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

CopilotAI review requested due to automatic review settings July 13, 2026 06:09

Copilotstarted reviewing on behalf of DaanHoogland July 13, 2026 06:10 View session

CopilotAI reviewed Jul 13, 2026
View reviewed changes

vishesh92 approved these changes Jul 13, 2026
View reviewed changes

vishesh92 merged commit e4f810b into apache:mainJul 13, 2026
3 checks passed

Navigation Menu

Uh oh!

Add security-model discoverability pointer to the project-wide CloudStack threat model - #149

Add security-model discoverability pointer to the project-wide CloudStack threat model#149
vishesh92 merged 4 commits into
apache:mainfrom
potiuk:asf-security/draft-threat-model-2026-05-30

potiuk commented May 30, 2026•
edited
Loading

Uh oh!

yadvr commented Jun 1, 2026

Uh oh!

DaanHoogland commented Jun 2, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

DaanHoogland commented Jun 2, 2026

Uh oh!

potiuk commented Jun 2, 2026

Uh oh!

potiuk commented Jun 2, 2026

Uh oh!

potiuk commented Jun 4, 2026

Uh oh!

potiuk commented Jun 5, 2026

Uh oh!

potiuk commented Jun 17, 2026

Uh oh!

CopilotAI left a comment

Uh oh!

Uh oh!

CopilotAI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

potiuk commented May 30, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

yadvr commented Jun 1, 2026

Uh oh!

DaanHoogland commented Jun 2, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

DaanHoogland commented Jun 2, 2026

Uh oh!

potiuk commented Jun 2, 2026

Uh oh!

potiuk commented Jun 2, 2026

Uh oh!

potiuk commented Jun 4, 2026

Uh oh!

potiuk commented Jun 5, 2026

Uh oh!

potiuk commented Jun 17, 2026

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

potiuk commented May 30, 2026•
edited
Loading