Team,

A “Lights On” feature for the 2019.05 release is “CVE Upgrades”.  This feature will enable ongoing security updates for the master branch and selectively provide CVE corrective content to supported releases.  The first step for this feature is to define a policy.  With the help of the Starling X security team, a draft of this policy has been provided below:

https://wiki.openstack.org/wiki/StarlingX/Security/CVE_Support_Policy

Please review and provide comments.  I plan to reserve a spot on the Community call for any discussion on Wednesday and start the discussion with the build team to identify tools to support this policy on Thursday.

Regards,

Ken Y