chore: add the §5.2 posture files this repository requires of others - #42
Conversation
The repository that defines §5.2 satisfied two of its six rows. README.md, NOTICE.md, CONTRIBUTING.md and SECURITY.md were all absent — so the Standard's own GitHub page showed no description of what the project is, no warranty disclaimer, no contribution terms, and no reporting channel. NOTICE.md and CONTRIBUTING.md derive from /spacecraft-software/license/. Both templates ship without SPDX tags and failed `reuse lint` on copy; headers are added here, and the templates themselves should be fixed at source. SECURITY.md is written for what this repository actually is. It holds no executable code, so the highest-value report is a normative defect with a security consequence — a clause that permits or fails to forbid something unsafe. §9.1 was exactly that: §9 was scoped to applications, so nothing forbade the published HTML from disclosing every reader's IP to a CDN. A wrong rule propagates to every project that follows it. README.md states the artifact, the build outputs, why the .md must not be hand-edited, and why the document keeps the Steelbore name while the umbrella does not. reuse lint: 17/17 files. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8bd4c79a39
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| The statements above describe the maintainer's posture in plain language. The | ||
| formal, legally binding terms are those of the **GNU General Public License, | ||
| version 3 or later** (`GPL-3.0-or-later`). In any conflict between this | ||
| notice and the license text, the license text governs. |
There was a problem hiding this comment.
For anyone relying on this notice to determine reuse rights, this incorrectly declares GPL-3.0-or-later to be the repository's binding license and then points to LICENSE, which actually contains CC-BY-SA-4.0. The same copied assumption appears in CONTRIBUTING.md lines 96–105 and would incorrectly place document contributions under GPL; distinguish the CC-BY-SA Standard and prose from the GPL-licensed CI tooling throughout these posture files.
AGENTS.md reference: AGENTS.md:L99-L103
Useful? React with 👍 / 👎.
| ## Self-application | ||
|
|
||
| The standard governs itself, and does so visibly: this repository is the §8 | ||
| Texinfo manual it mandates, its commits are §6.3-signed, its dates are §14 UTC |
There was a problem hiding this comment.
For this exact reviewed commit, git cat-file commit 2c3fe277 contains no gpgsig header, so the newly added assertion that this repository's commits are §6.3-signed is already false and the commit cannot satisfy the repository's non-negotiable shipping rule. Recreate this commit with an authorized cryptographic signature before merging it.
AGENTS.md reference: AGENTS.md:L90-L90
Useful? React with 👍 / 👎.
| 6. **Sign-off your commits** (`git commit -s`) under the | ||
| [Developer Certificate of Origin](https://developercertificate.org/). |
There was a problem hiding this comment.
For contributors following this checklist, git commit -s only adds a DCO sign-off trailer; checked git commit -h, which separately defines -S as --gpg-sign. Thus the documented workflow produces commits that still violate the repository's mandatory cryptographic-signing rule, so require both sign-off and a verified signature.
AGENTS.md reference: AGENTS.md:L90-L90
Useful? React with 👍 / 👎.
| 4. **Run the full test suite locally.** PRs that don't pass CI will not | ||
| be reviewed. | ||
| 5. **Use the project's preferred toolchain.** Format with `rustfmt`, | ||
| lint with `clippy -- -D warnings`, and run `cargo audit` for any | ||
| added dependency. |
There was a problem hiding this comment.
For any documentation contributor attempting to follow this prerequisite, the repository has no Cargo.toml, Rust source, or Cargo test suite, so rustfmt, clippy, and cargo audit cannot validate the proposed change while the actual Texinfo build check is omitted. Replace these copied software-template steps with this repository's makeinfo check and applicable CI validations.
AGENTS.md reference: AGENTS.md:L49-L51
Useful? React with 👍 / 👎.
| | Acknowledgement | within 7 days | | ||
| | Assessment | within 30 days | | ||
| | Supported versions | the current published version only; the Standard is not branched | | ||
| | Disclosure | coordinated; a corrective version lands before any public description | |
There was a problem hiding this comment.
When a reported vulnerability remains unfixed, this policy provides no point at which coordinated disclosure ends: saying that a corrective version lands before public description can postpone publication indefinitely. §26.1 requires the embargo and the point at which a finding is published regardless of fix status, so state a concrete default deadline here, including what happens if no corrective release is ready.
Useful? React with 👍 / 👎.
1 participant
The repository that defines §5.2 satisfied two of its six rows.
README.md,NOTICE.md,CONTRIBUTING.mdandSECURITY.mdwere all absent — so the Standard's own GitHub page showed no description of what the project is, no warranty disclaimer, no contribution terms, and no reporting channel.What's added
README.md.mdmust never be hand-edited, and why the document keeps the Steelbore name while the umbrella does notNOTICE.md/spacecraft-software/license/CONTRIBUTING.md/spacecraft-software/license/SECURITY.mdSECURITY.mdis not boilerplateThis repository holds no executable code, so the highest-value report is a normative defect with a security consequence — a clause that mandates, permits, or fails to forbid something unsafe.
§9.1 was exactly that. §9 was scoped to applications, so nothing forbade the published HTML from disclosing every reader's IP, User-Agent and Referer to a third-party CDN. A wrong rule propagates to every project that follows it, which makes it worth more than an exploit in a build script. The file says so, and asks reporters to name the section and the consequence rather than send a patch.
It also routes vulnerabilities in governed projects to those projects' own repositories.
One thing worth fixing at source
Both templates in
/spacecraft-software/license/ship without SPDX tags and failedreuse lintthe moment they were copied in. Headers are added to these copies, but the templates themselves are non-compliant and every repo that derives from them inherits the problem.Verification
reuse lint— 17/17 files. All ten §5.2 + §6.5 + §5.7 artifacts now present.🤖 Generated with Claude Code