Add a roller-security developer skill for report triage and coordination

skills/README.md

@@ -29,6 +29,7 @@ of living in one committer's head.
 | Skill | Covers |
 |---|---|
 | [`roller-release`](roller-release/SKILL.md) | Preparing, building, signing, verifying, staging, voting on and publishing a release, plus the release website and announcement drafts. |
+| [`roller-security`](roller-security/SKILL.md) | Security report triage, private case tracking, CVE preparation, reporter coordination and disclosure planning. |
 
 ## Reading them
 

skills/roller-security/SKILL.md

@@ -0,0 +1,120 @@
+---
+name: roller-security
+description: Triage Apache Roller security reports, maintain private case tracking, prepare CVE records, coordinate fixes and reporter review, and prepare disclosure with a release.
+---
+
+<!--
+Licensed to the Apache Software Foundation (ASF) under one or more
+contributor license agreements.  See the NOTICE file distributed with
+this work for additional information regarding copyright ownership.
+The ASF licenses this file to You under the Apache License, Version 2.0
+(the "License"); you may not use this file except in compliance with
+the License.  You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+
+# Apache Roller security response
+
+Use this workflow for vulnerability response, not ordinary bug fixes. The PMC
+owns acceptance, severity, release scope, and disclosure decisions. This skill
+supports those decisions; loading it does not authorize messages or publication.
+Parts are designed to work with Obsidian (the triage-<year> directory is a vault),
+but Obsidian is optional.
+
+## Confidentiality and project practice
+
+Keep reports, reproductions, CVE reservations, reporter identities, investigation
+notes, and disclosure schedules in a private workspace. If using `triage-<year>/`
+in a checkout, verify its local Git exclusion before adding case material.
+Exclusion prevents accidental additions; it is not access control and does not
+remove material from Git history. Never force-add private records.
+
+Roller uses public code review for fixes. Follow the PMC's agreed workflow and
+keep vulnerability characterization out of branch names, commits, PR text, tests,
+and comments until disclosure. Neutral wording alone does not prove that a diff
+is safe: review what the entire change reveals, including related cases. Resolve
+uncertainty with the PMC and ASF Security. Do not assume that derivability from
+public source makes an unannounced finding appropriate for publication.
+
+Keep only generic procedures and synthetic templates in this skill. Do not add
+live portal screenshots, case-derived examples, or release execution notes.
+
+## Read the case before acting
+
+1. Locate the private workspace and read its summary and the item's `TRACKING.md`.
+2. Read the original report, reproduction evidence and `IMPLEMENTATION.md`.
+3. Check the implementation branch, review state and release target against the
+   actual repository. Do not infer that a message was sent from a draft file.
+4. Reconcile `CVE_FORM.md` before using the portal or drafting an advisory.
+
+For new cases, copy `assets/item-template/` into a private item directory.
+`TRACKING.md` frontmatter stores facts; checkboxes store workflow state. The
+terminal board reads those files directly:
+
+```sh
+python3 skills/roller-security/scripts/triage-status.py "$TRIAGE_DIR"
+```
+
+Set `TRIAGE_DIR` to the actual private workspace. Commands above run from the
+Roller checkout root; when installed elsewhere, resolve scripts relative to this
+skill. Plain Markdown editing works; Obsidian Tasks is optional. Read
+[tracking conventions](references/obsidian-tasks-tracking.md) when creating or
+migrating records. Keep completion dates and mark irrelevant tasks explicitly.
+
+## Workflow
+
+Read [ASF process and routing](references/asf-process.md) for policy sources and
+project-specific decisions. Verify current policy when performing the workflow.
+
+1. Acknowledge receipt without inventing a verdict or fix commitment.
+2. Investigate reachability, actor privileges, configuration, affected versions,
+   impact and duplicates. Record evidence separately from inference. Use the
+   [codebase orientation](references/roller-codebase-map.md) to find entry points.
+3. Record the PMC's acceptance, rejection or duplicate decision. Explain a
+   rejection with verified reasons; re-evaluate each report independently.
+4. Tell the reporter the accepted remedy and any agreed schedule. Distinguish
+   planned work from completed work. Check existing credit preferences first;
+   ask when unclear. Use [communication templates](references/comms-templates.md).
+5. Assess [severity and CVSS](references/severity-and-cvss.md), reconcile the CVE
+   worksheet, and request an ID from ASF Security through the
+   [portal workflow](references/cve-portal.md).
+6. Implement and review the fix under the agreed project workflow. Demonstrate
+   that regression tests detect the reported behavior and pass with the fix;
+   keep sensitive reproduction evidence private. Use the target branch's
+   supported JDK and documented test commands, not a machine-specific SDK path.
+7. Give the reporter the fix and draft advisory for comment with a reasonable
+   deadline. Coordinate merge timing with the PMC; the ASF default places
+   reporter review before commit. Record any agreed project variation.
+8. Release the approved fix. The companion `roller-release` skill covers the
+   mechanics when available; otherwise use the project's release documentation.
+9. Coordinate disclosure with release availability, verify announcement recipients,
+   update public security information, and add announcement references to the CVE.
+   Do not rewrite pushed Git commits to add CVE IDs.
+
+## Multiple reports
+
+Give each case an owner and next task. Record shared code and duplicate
+relationships in frontmatter. Coordinate merge order when fixes overlap, and
+consider whether publishing one change reveals another case. Set release targets
+explicitly; the board's release gates are reminders, not release authorization.
+
+## Helpers and limits
+
+- `scripts/triage-status.py <triage-dir> [--mine <name>]` derives stages, next
+  tasks, blockers and consistency warnings without writing case data.
+- `scripts/migrate-status.py <triage-dir> [--write]` previews migration from
+  legacy `status.yml`; writes only when requested and retains legacy originals.
+- `scripts/check-private.sh [--range <revision-range>] [--pr <number>]` checks
+  common private paths and wording. Use explicit commit endpoints such as
+  `master..HEAD` (or `master...HEAD`); a lone revision such as `HEAD` is rejected.
+  Without `--range`, it checks the last 20 commit messages.
+  It is a heuristic, not publication approval:
+  manually inspect the full diff, filenames, screenshots, archives and PR text.
+  Public security documentation can legitimately trigger its vocabulary checks.

skills/roller-security/assets/SUMMARY.md

@@ -0,0 +1,92 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one or more
+contributor license agreements.  See the NOTICE file distributed with
+this work for additional information regarding copyright ownership.
+The ASF licenses this file to You under the Apache License, Version 2.0
+(the "License"); you may not use this file except in compliance with
+the License.  You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+
+# Apache Roller — [year] security triage (batch summary)
+
+> **PRIVATE — do not commit, do not discuss publicly.** `triage-[year]/` is
+> to be verified Git-excluded before use. These are undisclosed reports under the ASF
+> security process.
+
+The queries below are optional views for Obsidian with the Tasks plugin.
+Each item's `TRACKING.md` is authoritative: YAML frontmatter stores structured case
+facts, and Tasks checkboxes store all workflow state. Do not copy stage or next
+actions into prose here; they will drift.
+
+## Open work
+
+```tasks
+not done
+tags include #roller-security
+group by folder
+sort by priority
+sort by due
+```
+
+## Blocked work
+
+```tasks
+not done
+tags include #roller-security/blocked
+group by folder
+```
+
+For a terminal-friendly board and consistency checks, run:
+
+```sh
+python3 skills/roller-security/scripts/triage-status.py triage-[year]/
+```
+
+This file is for what the board cannot hold: provenance, the reasoning behind
+decisions, and the shape of the batch.
+
+## Provenance
+
+- Source: [who forwarded, from where, on what date]
+- Reporter(s): [name, contact, any affiliation]
+- Submitted: [date]  Verified against: [version @ commit]
+- Dashboard: <https://dash.security.apache.org/project/roller>
+- Notes on the forward itself: [what was supplied and what remains to be independently verified]
+
+## Batch shape
+
+Which items cluster, and why it matters for sequencing:
+
+- **[cluster name]** — items NN, NN. Same underlying pattern; one fix branch or
+  coordinated branches. [Merge order.]
+- **[cluster name]** — items NN, NN. Shared configuration prerequisite; assess each item independently.
+- **Duplicates / merges** — [item NN partly duplicates the closed report of
+  DATE; CVE merge or split discussed with security@apache.org on DATE].
+
+## Release plan
+
+Target: [version]. Rationale for bundling or splitting. Anything whose severity
+or reporter deadline argues for its own release, and the date that decision gets
+revisited.
+
+## Decision log
+
+Reasoning that would otherwise be lost. Append, don't rewrite — when a reporter
+or ASF Security asks in six months why something was closed, this is the answer.
+
+| Date | Item | Decision | Reasoning |
+|---|---|---|---|
+
+## Open questions for the PMC
+
+Things needing a `private@roller.apache.org` discussion rather than one person's
+call — scope of the security model, whether a behaviour is intended, whether to
+publish a Roller security page.

skills/roller-security/assets/item-template/CVE_FORM.md

@@ -0,0 +1,92 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one or more
+contributor license agreements.  See the NOTICE file distributed with
+this work for additional information regarding copyright ownership.
+The ASF licenses this file to You under the Apache License, Version 2.0
+(the "License"); you may not use this file except in compliance with
+the License.  You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+
+# CVE form — item NN: short title
+
+> **PRIVATE:** unpublished CVE entry worksheet; do not commit or disclose.
+
+**CVE disposition:** separate CVE
+**Portal record URL:** not yet created
+
+## Record
+
+| Portal field | Exact value |
+|---|---|
+| CVE ID | not yet allocated |
+| Apache PMC | `roller` |
+| Project list(s) | `dev@roller.apache.org, user@roller.apache.org` |
+| State | `DRAFT` |
+
+## Identity
+
+| Portal field | Exact value |
+|---|---|
+| Title | … |
+| Problem type | `CWE-NNN: Canonical Title` |
+| Source of vulnerability discovery | [verified discovery source] |
+
+## Affected product
+
+| Portal field | Exact value |
+|---|---|
+| Product name | `Apache Roller` |
+| Source repository | `https://github.com/apache/roller` |
+| Default status | `unknown` |
+
+| Status | Version | Less than | Less than or equal | Version type |
+|---|---|---|---|---|
+| affected | … | | | `semver` |
+
+## CVE Description
+
+```text
+Exact public text to paste.
+```
+
+## References
+
+| URL | Tag(s) |
+|---|---|
+| https://… | `patch` |
+
+## Rating Metric
+
+| Portal field | Exact value |
+|---|---|
+| Editor choice | `ASF severity rating` (or `Other` when the direct choice is absent) |
+| Generated metric | `Other` / `Textual description of severity` |
+| Text | [agreed ASF severity] |
+
+## CVSS (optional)
+
+| Version | Scenario | Vector | Score |
+|---|---|---|---|
+| `CVSS:…` | `GENERAL` | [vector for the selected CVSS version] | `…` |
+
+## Credits
+
+| Language | Public name | Role |
+|---|---|---|
+| `en` | … | `finder` |
+
+Add `Internal references`, `Defects`, `Advisory ID`, platforms, modules, source
+files/routines, Timeline, Tags, or internal Comments only when there is an actual
+value to enter. For a duplicate/merged report, use a short no-record form; for a
+pending report, record the pending disposition and unresolved decisions rather
+than a speculative form. `TRACKING.md` owns workflow state; `IMPLEMENTATION.md`
+owns the settled remedy; `REPRODUCTION.md` owns evidence — this worksheet holds
+only portal-entry values.

skills/roller-security/assets/item-template/IMPLEMENTATION.md

@@ -0,0 +1,70 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one or more
+contributor license agreements.  See the NOTICE file distributed with
+this work for additional information regarding copyright ownership.
+The ASF licenses this file to You under the Apache License, Version 2.0
+(the "License"); you may not use this file except in compliance with
+the License.  You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+
+# Item NN — [title]
+
+> **PRIVATE.** Undisclosed vulnerability under the ASF security process. This
+> directory must be verified Git-excluded before recording case details. Do not commit, do not
+> paste into a public issue, do not quote in a commit message.
+
+Case metadata and workflow: [[TRACKING]]
+
+Branch base: `master` @ `[sha]`
+
+## Verification
+
+What was checked, and how. The four things that decide severity:
+
+- **Reachability** — entry point, and the filter/interceptor path that reaches
+  it. Name files and lines.
+- **Actor** — anonymous / any authenticated user / `EDIT_DRAFT` / weblog admin /
+  global admin. Justify it; this is the biggest severity lever.
+- **Preconditions** — default config or not. Quote the property and its default
+  from `roller.properties`.
+- **Duplicate check** — which other items and previously closed reports were
+  checked, and the outcome.
+
+State plainly what was demonstrated versus inferred. Independently verify
+forwarded summaries and record unresolved assumptions.
+
+## Approach
+
+The fix pattern, and why this one rather than the alternatives. If the codebase
+already contains a safe version of this pattern elsewhere, name it — matching an
+existing idiom is easier to review and less likely to regress.
+
+## Changes
+
+| File | Change |
+|---|---|
+
+## Verified safe, deliberately NOT changed
+
+Call sites that look like they belong in the fix but don't, with the reason for
+each. This section is worth as much as the fix itself: it is what stops the next
+person re-opening settled ground, and it is what a reviewer checks first.
+
+## Tests
+
+Test classes, behavior covered, and evidence that the tests detect the reported
+problem and pass with the fix. Record any limits to the verification.
+
+Full suite result and JDK used: [N run, N failures, N errors, N skipped]
+
+## Open questions
+
+Anything left for the PMC or the reporter to decide.