chore: update security docs to mention release frequency and srus by blackboxsw · Pull Request #7013 · canonical/cloud-init

blackboxsw · 2026-08-19T18:02:16Z

Proposed Commit Message

docs(security): report security release frequency and srus use gh milestones

Also correct release schedule links

Additional Context

Test Steps

Merge type

Squash merge using "Proposed Commit Message"
Rebase and merge unique commits. Requires commit messages per-commit each referencing the pull request number (#<PR_NUM>)

holmanb · 2026-08-19T18:19:46Z

+
+## Supported versions
+
+Cloud-init upstream creates [4 time-based releases per year](https://github.com/canonical/cloud-init/milestones).


Is this important to document? It wasn't true last year, maybe we just don't need it.

consolidated this statement and link into the following sentence

Also correct release schedule link

blackboxsw · 2026-08-20T13:38:17Z

Added #7016 due to 340ac74 now causing format issues with separately landed 34c74ef

holmanb · 2026-08-20T21:04:09Z

+[latest Ubuntu interim release and the two most recent Ubuntu LTS releases](https://ubuntu.com/about/release-cycle) to
+ensure security bug fixes are published to stable Ubuntu LTS releases.


time-based

The word "scheduled" seems more natural here.

is published to the ... Ubuntu ... release

It seems imprecise to say that a cloud-init release is published to an Ubuntu release.

to
ensure security bug fixes are published to stable Ubuntu LTS releases.

I disagree.

Replaced scheduled, s/published/included

Each cloud-init scheduled upstream release is provided as updates to the latest Ubuntu interim release and the two most recent Ubuntu LTS releases to ensure common behavior of cloud-init on all Ubuntu standard security maintenance releases.

holmanb · 2026-08-20T21:10:52Z

+[latest Ubuntu interim release and the two most recent Ubuntu LTS releases](https://ubuntu.com/about/release-cycle) to
+ensure security bug fixes are published to stable Ubuntu LTS releases.
+
+If a CVE is of critical CVSS severity and affects older Ubuntu LTS releases, it will be backported to the specific release.


critical

Why only critical? Is this some Ubuntu-wide policy?

and affects older Ubuntu LTS releases, it will be backported to the specific release.

Are you sure? This statement is unbounded.

I should have listed High in there too. Ubuntu ESM CVE policy. Updated critical and high

Updated the statement:
CVEs of critical or high CVSS severity will be backported to all LTS releases and the two most recent ESM releases supported under Ubuntu Pro.

What happens if the Ubuntu ESM CVE policy changes? Why not just link to it rather than copying it?

Changed to lnk direcly to the ESM CVE policy doc. If it changes, our policy changes. I was thinking cloud-init may have a slightly limited view of this policy for very old ESM series to limit support exposure. But, looking at our internal CVE-related bug fixes on older cloud-init series as a guideline, the maintenance isn't currently something that is cause for concern.

…verity

holmanb

Thanks, more comments.

holmanb · 2026-09-02T20:31:02Z

+
+## Supported versions
+
+Each [cloud-init scheduled upstream release](https://github.com/canonical/cloud-init/milestones) is provided as updates to the [latest Ubuntu interim release and the two most recent Ubuntu LTS releases](https://ubuntu.com/about/release-cycle) to ensure common behavior of cloud-init on all Ubuntu standard security maintenance releases.


This is really long, and I can easily interpret this multiple ways. Can we trim this and be more precise?

holmanb · 2026-09-10T17:14:35Z

+Each [cloud-init upstream release](https://github.com/canonical/cloud-init/milestones) is published to the
+[Ubuntu interim release and the two most recent Ubuntu LTS releases](https://ubuntu.com/about/release-cycle) to ensure stable cloud-init behavior on recent releases.


This still seems confused. Without knowing what an Ubuntu interim release is, this would be confusing to read.

Also, this file is an upstream document - why is Ubuntu-specific showing up here?

Ubuntu shows up here in a security context because additional work is performed by the upstream project to ensure that CVE's are properly mitigated in a known Ubuntu downstreams. Since upstream also documents the cloud-init Ubuntu SRU policy, I have simplified this text further and pointed to cloud-init stable_release_updates as well as scoping this security section to # Downstream supported versions. If other downstreams want to represent their treatment of security vulnerabilities I think this is reasonable place to document such treatment or cross link from.

holmanb · 2026-09-10T17:24:43Z

-To ensure the available security fixes are applied to you VMs images upon
-launch, it is recommended by `Ubuntu security team guidelines`_ to update
-the packages
+To ensure the available security fixes are applied to images at launch,
+it is recommended by `Ubuntu security team guidelines`_ to update the packages

 .. note::

-  Ubuntu cloud images are configured by default to enable unattended-upgrades,
-  thus this is resolved this issue when the update gets triggered. One can
-  still apply this recommendation to cloud that gap and update the packages
-  on first boot.
+  Ubuntu cloud images enable unattended-upgrades by default, so this issue
+  resolves automatically as daily scheduled upgrades run. For images without
+  automated upgrades, follow this recommendation to update packages on first boot.


This appears self-contradictory. This first paragraph says that the Ubuntu security team guidelines recommend updating packages. The second paragraph says that Ubuntu cloud images don't need to be updated since that happens automatically.

Something like this would be more straightfoward.

Some cloud images (such as Ubuntu) are configured to automatically receive the latest security updates. Other images should use cloud-init to update packages on first boot.

Good suggestion, unattended-upgrades is a distro-specific implementation detail. I have applied your suggestion.

It doesn't look like you did.

blackboxsw

Thank you for this thoughtful review. I have updated both docs

blackboxsw · 2026-09-10T23:14:53Z

+Each [cloud-init upstream release](https://github.com/canonical/cloud-init/milestones) is published to the
+[Ubuntu interim release and the two most recent Ubuntu LTS releases](https://ubuntu.com/about/release-cycle) to ensure stable cloud-init behavior on recent releases.


Ubuntu shows up here in a security context because additional work is performed by the upstream project to ensure that CVE's are properly mitigated in a known Ubuntu downstreams. Since upstream also documents the cloud-init Ubuntu SRU policy, I have simplified this text further and pointed to cloud-init stable_release_updates as well as scoping this security section to # Downstream supported versions. If other downstreams want to represent their treatment of security vulnerabilities I think this is reasonable place to document such treatment or cross link from.

blackboxsw · 2026-09-10T23:17:24Z

-To ensure the available security fixes are applied to you VMs images upon
-launch, it is recommended by `Ubuntu security team guidelines`_ to update
-the packages
+To ensure the available security fixes are applied to images at launch,
+it is recommended by `Ubuntu security team guidelines`_ to update the packages

 .. note::

-  Ubuntu cloud images are configured by default to enable unattended-upgrades,
-  thus this is resolved this issue when the update gets triggered. One can
-  still apply this recommendation to cloud that gap and update the packages
-  on first boot.
+  Ubuntu cloud images enable unattended-upgrades by default, so this issue
+  resolves automatically as daily scheduled upgrades run. For images without
+  automated upgrades, follow this recommendation to update packages on first boot.


Good suggestion, unattended-upgrades is a distro-specific implementation detail. I have applied your suggestion.

holmanb · 2026-09-11T18:45:39Z

-To ensure the available security fixes are applied to you VMs images upon
-launch, it is recommended by `Ubuntu security team guidelines`_ to update
-the packages
+To ensure the available security fixes are applied to images at launch,
+it is recommended by `Ubuntu security team guidelines`_ to update the packages

 .. note::

-  Ubuntu cloud images are configured by default to enable unattended-upgrades,
-  thus this is resolved this issue when the update gets triggered. One can
-  still apply this recommendation to cloud that gap and update the packages
-  on first boot.
+  Ubuntu cloud images enable unattended-upgrades by default, so this issue
+  resolves automatically as daily scheduled upgrades run. For images without
+  automated upgrades, follow this recommendation to update packages on first boot.


It doesn't look like you did.

holmanb · 2026-09-11T18:46:30Z

  mitigations and where to obtain the fix
 * An announcement is made to [GitHub Discussions](https://github.com/canonical/cloud-init/discussions)
+
+## Downstream supported versions


What does "Downstream supported versions" mean in the context of a SECURITY.md?

Maybe a more appropriate title would be Downstream security patches, Downstream vulnerability resolution or Supported downstream security updates?

The context is that I want upstream to represent how some downstreams handle CVE vulnerability resolution so we can point to it when community has questions about how Ubuntu or others deal with security vulnerabilities in cloud-init in a given distribution.

I've retitled this Downstream CVE mitigation and moved the majority of the content into a specific section of ubuntu_stable_release_updates page.

The reason I felt downstreams should be represented here is to capture some of the supplemental, security-scoped work that is represented by downstreams from the single SECURITY.md page. It ensures that security-focused readers are aware of various downstream efforts or policies related to treatment of cloud-init CVEs.

holmanb · 2026-09-11T18:46:59Z

+
+## Downstream supported versions
+
+[Ubuntu ESM CVE policy](https://ubuntu.com/security/cves/about) is followed to determine when to backport CVEs to [Ubuntu SRU supported releases](https://docs.cloud-init.io/en/latest/reference/ubuntu_stable_release_updates.html).


to determine when to backport CVEs

I really hope that we aren't backporting CVEs.

True. We are resolving CVEs when they affect stable supported releases. updated text.

github-actions Bot added the documentation This Pull Request changes documentation label Aug 19, 2026

holmanb requested changes Aug 19, 2026

View reviewed changes

chore: update security docs to mention release frequency and srus

8fd50b7

Also correct release schedule link

blackboxsw force-pushed the update-release-security-docs branch from f5b9ba1 to 8fd50b7 Compare August 19, 2026 22:43

blackboxsw requested a review from holmanb August 19, 2026 22:44

holmanb requested changes Aug 20, 2026

View reviewed changes

holmanb self-assigned this Aug 20, 2026

doc: more concise support matrix for SRUs and CVE support for high se…

13c080e

…verity

holmanb reviewed Sep 2, 2026

View reviewed changes

blackboxsw added 2 commits September 4, 2026 15:54

doc: supported versions more concise refer to security docs

8a47f55

doc: fix incorrect grammar for unattended-upgrades

e44d5a9

blackboxsw requested a review from holmanb September 5, 2026 02:49

holmanb requested changes Sep 10, 2026

View reviewed changes

blackboxsw added 2 commits September 10, 2026 17:10

doc: scope the supported versions docs to downstream

f79c0d6

doc: simplify package upgrade note, avoid unattended-upgrades detail

ec3ffcf

blackboxsw commented Sep 10, 2026

View reviewed changes

holmanb requested changes Sep 11, 2026

View reviewed changes

blackboxsw added 2 commits September 11, 2026 13:39

doc: we resolve CVEs we do not backport them

a98f02d

doc: move ubuntu specific security mitigation into ubuntu_sru page

e48fbdf


		## Supported versions

		Cloud-init upstream creates [4 time-based releases per year](https://github.com/canonical/cloud-init/milestones).

		[latest Ubuntu interim release and the two most recent Ubuntu LTS releases](https://ubuntu.com/about/release-cycle) to
		ensure security bug fixes are published to stable Ubuntu LTS releases.


		## Supported versions

		Each [cloud-init scheduled upstream release](https://github.com/canonical/cloud-init/milestones) is provided as updates to the [latest Ubuntu interim release and the two most recent Ubuntu LTS releases](https://ubuntu.com/about/release-cycle) to ensure common behavior of cloud-init on all Ubuntu standard security maintenance releases.

		Each [cloud-init upstream release](https://github.com/canonical/cloud-init/milestones) is published to the
		[Ubuntu interim release and the two most recent Ubuntu LTS releases](https://ubuntu.com/about/release-cycle) to ensure stable cloud-init behavior on recent releases.


		## Downstream supported versions

		[Ubuntu ESM CVE policy](https://ubuntu.com/security/cves/about) is followed to determine when to backport CVEs to [Ubuntu SRU supported releases](https://docs.cloud-init.io/en/latest/reference/ubuntu_stable_release_updates.html).

Uh oh!

Conversation

blackboxsw commented Aug 19, 2026

Proposed Commit Message

Additional Context

Test Steps

Merge type

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

blackboxsw commented Aug 20, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

holmanb left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

blackboxsw left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants