<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>OSGeo has gitea in SAC. We can have a private mapserver repo there. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Mike<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='font-size:10.5pt;color:black'>--<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.5pt;color:black'>Michael Smith</span><o:p></o:p></p><div><p class=MsoNormal><span style='font-size:10.5pt;color:black'>OSGeo Foundation Treasurer<o:p></o:p></span></p></div><p class=MsoNormal><span style='font-size:10.5pt;color:black'>treasurer@osgeo.org</span><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span style='font-size:12.0pt;color:black'>From: </span></b><span style='font-size:12.0pt;color:black'>mapserver-dev <mapserver-dev-bounces@lists.osgeo.org> on behalf of Steve Lime <sdlime@gmail.com><br><b>Date: </b>Friday, February 28, 2020 at 12:16 PM<br><b>To: </b>Even Rouault <even.rouault@spatialys.com><br><b>Cc: </b>MapServer Dev Mailing List <mapserver-dev@lists.osgeo.org><br><b>Subject: </b>Re: [mapserver-dev] Motion: Updating the security reporting and workflow process<o:p></o:p></span></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>The collaborator limit does kinda suck. We can't host private repos under the MapServer account. Github want projects to move to "teams" - $304/mo based on our current size. Gitlab would certainly work for a single purpose private repo. <o:p></o:p></p></div><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal>On Fri, Feb 28, 2020 at 11:06 AM Even Rouault <<a href="mailto:even.rouault@spatialys.com">even.rouault@spatialys.com</a>> wrote:<o:p></o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm'><p class=MsoNormal>On vendredi 28 février 2020 12:36:54 CET Jeff McKenna wrote:<br>> There is now a new alias that users can send an initial report to, that<br>> forwards to all PSC members: mapserver-security (at) osgeo (dot) org<br>> <br>> SteveL has also setup a private 'mapserver-private' repository on<br>> Github, to handle valid security reports, privately.<br>> <br>> So therefore:<br>> <br>> Motion: update documentation<br>> (<a href="https://mapserver.org/development/bugs.html" target="_blank">https://mapserver.org/development/bugs.html</a>) to list the steps to<br>> report a security concern, mentioning the first step of sending report<br>> to mapserver-security (at), and second step of a PSC member creating a<br>> ticket in the 'mapserver-private' repository.<br><br>As apparently there's a limit to the number of collaborators for a private <br>github repo, perhaps GitLab could be an option ?<br>Some doc at<br><a href="https://docs.gitlab.com/ee/user/project/issues/confidential_issues.html" target="_blank">https://docs.gitlab.com/ee/user/project/issues/confidential_issues.html</a><br>(I've not experience with that myself.)<br><br>Even<br><br>-- <br>Spatialys - Geospatial professional services<br><a href="http://www.spatialys.com" target="_blank">http://www.spatialys.com</a><br>_______________________________________________<br>mapserver-dev mailing list<br><a href="mailto:mapserver-dev@lists.osgeo.org" target="_blank">mapserver-dev@lists.osgeo.org</a><br><a href="https://lists.osgeo.org/mailman/listinfo/mapserver-dev" target="_blank">https://lists.osgeo.org/mailman/listinfo/mapserver-dev</a><o:p></o:p></p></blockquote></div><p class=MsoNormal>_______________________________________________ mapserver-dev mailing list mapserver-dev@lists.osgeo.org https://lists.osgeo.org/mailman/listinfo/mapserver-dev<o:p></o:p></p></div></body></html>