安全政策

本政策可能是 Rust 社群成員所翻譯。若翻譯版本有任何與英文版本衝突之處，以英文版本為依歸。

回報漏洞

Safety is one of the core principles of Rust, and to that end, we would like to ensure that Rust has a secure implementation. Thank you for taking the time to responsibly disclose any issues you find.

All security bugs in the Rust distribution should be reported by email to security@rust-lang.org. This list is delivered to a small security team. Your email will be acknowledged within 24 hours, and you’ll receive a more detailed response to your email within 48 hours indicating the next steps in handling your report. If you would like, you can encrypt your report using our public key. This key is also On MIT’s keyserver and reproduced below.

This email address receives a large amount of spam, so be sure to use a descriptive subject line to avoid having your report be missed. After the initial reply to your report, the security team will endeavor to keep you informed of the progress being made towards a fix and full announcement. As recommended by RFPolicy, these updates will be sent at least every five days. In reality, this is more likely to be every 24-48 hours.

If you have not received a reply to your email within 48 hours, or have not heard from the security team for the past five days, there are a few steps you can take (in order):

Contact both the security coordinators directly:
- Josh Stone
- Pietro Albini
Post on the internals forums

Please note that the discussion forums are public areas. When escalating in these venues, please do not discuss your issue. Simply say that you’re trying to get a hold of someone from the security team.

寄送 Email 給 security@rust-lang.org

資訊揭露政策

Rust 專案有五步處理漏洞的流程

收到一個安全報告後會指派一個主要處理者，由此人負責協調修復漏洞與發怖安全版本的流程
確認問題並列出所有受其影響的版本
審核程式碼以找出任何潛在問題
對所有仍在維護的發行版本進行修復，這些修復不會推送到公共 repository，而是保留在本地，等待發怖
過封鎖期後Rust 安全公告郵件列表將發布一份公告副本。這些更改會提交至公共 repository，新的程序會部署至 rust-lang.org。在收到郵件列表通知的 6 小時內，Rust blog 將發怖該通報的副本。

這些流程可能會花費不少時間，特別是需要和其他專案的維護者協調的時候。我们將進一切努力即時處理錯誤，但我們仍要遵照以上的流程來確保以一致的方式處理漏洞

接受安全更新

接收所有安全公告的最好方式是訂閱 Rust 安全公告郵件列表（或是發送電子郵件至 rustlang-security-announcements+subscribe@googlegroups.com ）。郵件列表的信件量很少，在解禁後會立即收到公眾通知。

我們會在解禁前 72 小時內向 distros@openwall 公佈漏洞，以便 Linux 發行版去更新套件。

明文 PGP 公鑰