chore: update security docs to mention release frequency and srus - #7013
chore: update security docs to mention release frequency and srus#7013blackboxsw wants to merge 1 commit into
Conversation
github-actions
Bot
added
the
documentation
|
|
||
| ## Supported versions | ||
|
|
||
| Cloud-init upstream creates [4 time-based releases per year](https://github.com/canonical/cloud-init/milestones). |
There was a problem hiding this comment.
Is this important to document? It wasn't true last year, maybe we just don't need it.
There was a problem hiding this comment.
consolidated this statement and link into the following sentence
Also correct release schedule link
f5b9ba1 to
8fd50b7
Compare
| [latest Ubuntu interim release and the two most recent Ubuntu LTS releases](https://ubuntu.com/about/release-cycle) to | ||
| ensure security bug fixes are published to stable Ubuntu LTS releases. |
There was a problem hiding this comment.
time-based
The word "scheduled" seems more natural here.
is published to the ... Ubuntu ... release
It seems imprecise to say that a cloud-init release is published to an Ubuntu release.
to
ensure security bug fixes are published to stable Ubuntu LTS releases.
I disagree.
| [latest Ubuntu interim release and the two most recent Ubuntu LTS releases](https://ubuntu.com/about/release-cycle) to | ||
| ensure security bug fixes are published to stable Ubuntu LTS releases. | ||
|
|
||
| If a CVE is of critical CVSS severity and affects older Ubuntu LTS releases, it will be backported to the specific release. |
There was a problem hiding this comment.
critical
Why only critical? Is this some Ubuntu-wide policy?
and affects older Ubuntu LTS releases, it will be backported to the specific release.
Are you sure? This statement is unbounded.
| To ensure the available security fixes are applied to you VMs images upon | ||
| launch, it is recommended by `Ubuntu security team guidelines`_ to update | ||
| the packages | ||
| To ensure the available security fixes are applied to VM images at launch, |
There was a problem hiding this comment.
Cloud-init is not limited to VM images.
2 participants
Proposed Commit Message
Additional Context
Test Steps
Merge type