update security contact information.

Point out that the security-reporting email address now creates an RT
ticket. Also, consolidate this information purely within perlsec.pod, and
make all the other places link to it with L<>.

diff --git a/INSTALL b/INSTALL
index 60ccad1..ec92352 100644 (file)
--- a/INSTALL
+++ b/INSTALL
@@ -2426,15 +2426,10 @@ attachments or encodings may actually reduce the number of people who
 read your message.  Your message will get relayed to over 400
 subscribers around the world so please try to keep it brief but clear.
 
-If the bug you are reporting has security implications, which make it
-inappropriate to send to a publicly archived mailing list, then please
-send it to perl5-security-report@perl.org. This points to a closed
-subscription unarchived mailing list, which includes all the core
-committers, who be able to help assess the impact of issues, figure out
-a resolution, and help co-ordinate the release of patches to mitigate or
-fix the problem across all platforms on which Perl is supported. Please
-only use this address for security issues in the Perl core, not for
-modules independently distributed on CPAN.
+If the bug you are reporting has security implications which make it
+inappropriate to send to a publicly archived mailing list, then see
+L<perlsec/SECURITY VULNERABILITY CONTACT INFORMATION>
+for details of how to report the issue.
 
 If you are unsure what makes a good bug report please read "How to
 report Bugs Effectively" by Simon Tatham:

diff --git a/Porting/perldelta_template.pod b/Porting/perldelta_template.pod
index 696de31..cd912cb 100644 (file)
--- a/Porting/perldelta_template.pod
+++ b/Porting/perldelta_template.pod
@@ -392,15 +392,10 @@ included with your release.  Be sure to trim your bug down to a tiny but
 sufficient test case.  Your bug report, along with the output of C<perl -V>,
 will be sent off to perlbug@perl.org to be analysed by the Perl porting team.
 
-If the bug you are reporting has security implications, which make it
-inappropriate to send to a publicly archived mailing list, then please send it
-to perl5-security-report@perl.org.  This points to a closed subscription
-unarchived mailing list, which includes all the core committers, who will be
-able to help assess the impact of issues, figure out a resolution, and help
-co-ordinate the release of patches to mitigate or fix the problem across all
-platforms on which Perl is supported.  Please only use this address for
-security issues in the Perl core, not for modules independently distributed on
-CPAN.
+If the bug you are reporting has security implications which make it
+inappropriate to send to a publicly archived mailing list, then see
+L<perlsec/SECURITY VULNERABILITY CONTACT INFORMATION>
+for details of how to report the issue.
 
 =head1 SEE ALSO
 

diff --git a/pod/perldelta.pod b/pod/perldelta.pod
index 4cf4422..57cf7c1 100644 (file)
--- a/pod/perldelta.pod
+++ b/pod/perldelta.pod
@@ -395,15 +395,10 @@ included with your release.  Be sure to trim your bug down to a tiny but
 sufficient test case.  Your bug report, along with the output of C<perl -V>,
 will be sent off to perlbug@perl.org to be analysed by the Perl porting team.
 
-If the bug you are reporting has security implications, which make it
-inappropriate to send to a publicly archived mailing list, then please send it
-to perl5-security-report@perl.org.  This points to a closed subscription
-unarchived mailing list, which includes all the core committers, who will be
-able to help assess the impact of issues, figure out a resolution, and help
-co-ordinate the release of patches to mitigate or fix the problem across all
-platforms on which Perl is supported.  Please only use this address for
-security issues in the Perl core, not for modules independently distributed on
-CPAN.
+If the bug you are reporting has security implications which make it
+inappropriate to send to a publicly archived mailing list, then see
+L<perlsec/SECURITY VULNERABILITY CONTACT INFORMATION>
+for details of how to report the issue.
 
 =head1 SEE ALSO
 

diff --git a/pod/perlpolicy.pod b/pod/perlpolicy.pod
index 063dae5..c5ddae7 100644 (file)
--- a/pod/perlpolicy.pod
+++ b/pod/perlpolicy.pod
@@ -120,8 +120,8 @@ beyond our 3 year support commitment.  We can provide limited support and
 advice to you as you do so and, where possible will try to apply
 those patches to the relevant -maint branches in git, though we may or
 may not choose to make numbered releases or "official" patches
-available.  Contact us at E<lt>perl5-security-report@perl.orgE<gt>
-to begin that process.
+available. See L<perlsec/SECURITY VULNERABILITY CONTACT INFORMATION>
+for details on how to begin that process.
 
 =back
 
@@ -274,8 +274,8 @@ not also fall into any of the "unacceptable" categories set out below:
 =item *
 
 Patches that fix CVEs or security issues.  These changes should
-be run through the perl5-security-report@perl.org mailing list
-rather than applied directly.
+be passed using the security reporting mechanism rather than applied
+directly; see L<perlsec/SECURITY VULNERABILITY CONTACT INFORMATION>.
 
 =item *
 

diff --git a/pod/perlsec.pod b/pod/perlsec.pod
index 75ce3fd..6eb1bd2 100644 (file)
--- a/pod/perlsec.pod
+++ b/pod/perlsec.pod
@@ -14,11 +14,24 @@ untrustworthy) programs to accomplish its purposes.
 
 =head1 SECURITY VULNERABILITY CONTACT INFORMATION
 
-If you believe you have found a security vulnerability in Perl, please email
-perl5-security-report@perl.org with details.  This points to a closed
-subscription, unarchived mailing list.  Please only use this address for
-security issues in the Perl core, not for modules independently distributed on
-CPAN.
+If you believe you have found a security vulnerability in Perl, please
+email the details to perl5-security-report@perl.org. This creates a new
+Request Tracker ticket in a special queue which isn't initially publicly
+accessible. The email will also be copied to a closed subscription
+unarchived mailing list which includes all the core committers, who will
+be able to help assess the impact of issues, figure out a resolution, and
+help co-ordinate the release of patches to mitigate or fix the problem
+across all platforms on which Perl is supported. Please only use this
+address for security issues in the Perl core, not for modules
+independently distributed on CPAN.
+
+When sending an initial request to the security email address, please
+don't Cc any other parties, because if they reply to all, the reply will
+generate yet another new ticket. Once you have received an initial reply
+with a C<[perl #NNNNNN]> ticket number in  the headline, it's okay to Cc
+subsequent replies to third parties: all emails to the
+perl5-security-report address with the ticket number in the subject line
+will be added to the ticket; without it, a new ticket will be created.
 
 =head1 SECURITY MECHANISMS AND CONCERNS