jochen
10f76cafc4
Betterbird's pinned .tar.xz failed on the build seat with "this build seat has no xz to read it": the seat's image is the catalogue's build-agent recipe, which installs git and docker-cli alone, and xz had been added only to cmd/mesh-builder/Dockerfile, which the seat does not build from. The stream is now read with github.com/ulikunitz/xz (vendored), its dictionary capped at xz's own largest preset, and what it unpacks to bounded as before; the xz line in the unused Dockerfile is taken back out.
20 lines
760 B
Markdown
20 lines
760 B
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
Currently the last minor version v0.5.x is supported.
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
You can privately report a vulnerability following this
|
|
[procedure](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability).
|
|
Alternatively you can create a Github issue at
|
|
<https://github.com/ulikunitz/xz/issues>.
|
|
|
|
In both cases expect a response in at least 7 days.
|
|
|
|
## Security Advisories
|
|
|
|
All security advisories for this project are published under
|
|
[github.com/ulikunitz/xz/security/advisories](https://github.com/ulikunitz/xz/security/advisories?state=published).
|