From 86d942ec8c81a88f7ee0ce5ae4c780c8da78417f Mon Sep 17 00:00:00 2001 From: KKRainbow <5665404+KKRainbow@users.noreply.github.com> Date: Thu, 10 Sep 2026 12:30:49 +0800 Subject: [PATCH] docs: add security reporting policy (#2561) * docs(security): add private reporting policy Document supported versions and route vulnerability reports through GitHub's private advisory workflow. Add English and Chinese responsible-use notices to the READMEs. Closes #2544 * ci: skip unrelated pull request builds Use pull-request-aware path filtering for required Core, GUI, Mobile, and Test workflows so they still publish required check contexts without launching expensive jobs for documentation changes. Limit the optional OHOS pull request workflow to relevant paths. --- .github/SECURITY.md | 28 ++++++++++++++++++++++++++++ .github/SECURITY.zh-CN.md | 28 ++++++++++++++++++++++++++++ .github/workflows/core.yml | 36 ++++++++++++++++++++++++++++++------ .github/workflows/gui.yml | 36 +++++++++++++++++++++++++++++++----- .github/workflows/mobile.yml | 36 +++++++++++++++++++++++++++++++----- .github/workflows/ohos.yml | 12 ++++++++++++ .github/workflows/test.yml | 31 ++++++++++++++++++++++++++----- README.md | 6 ++++++ README_CN.md | 4 ++++ 9 files changed, 196 insertions(+), 21 deletions(-) create mode 100644 .github/SECURITY.md create mode 100644 .github/SECURITY.zh-CN.md diff --git a/.github/SECURITY.md b/.github/SECURITY.md new file mode 100644 index 00000000..654a583d --- /dev/null +++ b/.github/SECURITY.md @@ -0,0 +1,28 @@ +# Security Policy + +[简体中文](SECURITY.zh-CN.md) | English + +## Supported Versions + +Security updates are provided for the latest EasyTier release. Before reporting a vulnerability, please verify it against the latest release or the current `main` branch when practical. + +| Version | Supported | +| --- | --- | +| Latest release | Yes | +| Older releases | No | + +## Reporting a Vulnerability + +Please report suspected vulnerabilities through GitHub's [private vulnerability reporting form](https://github.com/EasyTier/EasyTier/security/advisories/new). + +Do not disclose the vulnerability in a public issue, discussion, or pull request. A useful report should include: + +- the affected EasyTier version or commit; +- the affected platform and relevant configuration, with secrets removed; +- a description of the vulnerability and its potential impact; +- reproducible steps or a minimal proof of concept; and +- any known mitigations or workarounds. + +The maintainers will assess the report and coordinate remediation and disclosure through the private advisory. Please allow reasonable time for a fix before publishing details. + +When investigating, avoid accessing or modifying other users' data, disrupting services, or violating applicable laws. diff --git a/.github/SECURITY.zh-CN.md b/.github/SECURITY.zh-CN.md new file mode 100644 index 00000000..8ea111c0 --- /dev/null +++ b/.github/SECURITY.zh-CN.md @@ -0,0 +1,28 @@ +# 安全策略 + +简体中文 | [English](SECURITY.md) + +## 支持的版本 + +EasyTier 仅为最新正式版本提供安全更新。报告漏洞前，请尽可能在最新正式版本或当前 `main` 分支上确认问题仍然存在。 + +| 版本 | 是否支持 | +| --- | --- | +| 最新正式版本 | 是 | +| 更早版本 | 否 | + +## 报告安全漏洞 + +请通过 GitHub 的[私有漏洞报告表单](https://github.com/EasyTier/EasyTier/security/advisories/new)报告疑似安全漏洞。 + +请勿在公开 Issue、Discussion 或 Pull Request 中披露漏洞。一份有效的报告应包括： + +- 受影响的 EasyTier 版本或提交； +- 受影响的平台和相关配置，请移除其中的密钥等敏感信息； +- 漏洞说明及其潜在影响； +- 可复现的步骤或最小概念验证； +- 已知的缓解措施或临时解决方案。 + +维护者将评估报告，并通过私有安全公告协调修复和披露。请在公开漏洞详情前为修复预留合理时间。 + +调查漏洞时，请勿访问或修改其他用户的数据、干扰服务或违反适用的法律法规。 diff --git a/.github/workflows/core.yml b/.github/workflows/core.yml index a50ed9c6..dd65ea6b 100644 --- a/.github/workflows/core.yml +++ b/.github/workflows/core.yml @@ -22,22 +22,46 @@ defaults: jobs: pre_job: - # continue-on-error: true # Uncomment once integration is finished runs-on: ubuntu-latest if: github.event_name != 'pull_request' || !github.event.pull_request.draft - # Map a step output to a job output + env: + RELEVANT_PATHS: >- + ["Cargo.toml", "Cargo.lock", "rust-toolchain.toml", ".cargo/**", + "pnpm-lock.yaml", "pnpm-workspace.yaml", "package.json", "easytier/**", + "easytier-core/**", "easytier-proto/**", "easytier-rpc-build/**", + "easytier-web/**", "easytier-contrib/easytier-magisk/**", + ".github/workflows/core.yml", ".github/actions/**"] outputs: - # do not skip push on branch starts with releases/ - should_skip: ${{ steps.skip_check.outputs.should_skip == 'true' && !startsWith(github.ref_name, 'releases/') }} + # Release builds must run even if they only change release metadata. + should_skip: >- + ${{ + ( + steps.skip_check.outputs.should_skip == 'true' || + ( + github.event_name == 'pull_request' && + steps.path_filter.outputs.relevant != 'true' + ) + ) && + !startsWith(github.ref_name, 'releases/') + }} steps: - id: skip_check uses: fkirc/skip-duplicate-actions@v5 with: - # All of these options are optional, so you can remove them if you are happy with the defaults concurrent_skipping: 'same_content_newer' skip_after_successful_duplicate: 'true' cancel_others: 'true' - paths: '["Cargo.toml", "Cargo.lock", "easytier/**", "easytier-core/**", "easytier-proto/**", ".github/workflows/core.yml", ".github/actions/**", "easytier-web/**"]' + paths: ${{ env.RELEVANT_PATHS }} + + - id: path_filter + if: >- + github.event_name == 'pull_request' && + steps.skip_check.outputs.should_skip != 'true' + uses: dorny/paths-filter@v4 + with: + filters: | + relevant: ${{ env.RELEVANT_PATHS }} + build_web: runs-on: ubuntu-latest needs: pre_job diff --git a/.github/workflows/gui.yml b/.github/workflows/gui.yml index b053139b..e07ccc0a 100644 --- a/.github/workflows/gui.yml +++ b/.github/workflows/gui.yml @@ -21,21 +21,47 @@ defaults: jobs: pre_job: - # continue-on-error: true # Uncomment once integration is finished runs-on: ubuntu-latest if: github.event_name != 'pull_request' || !github.event.pull_request.draft - # Map a step output to a job output + env: + RELEVANT_PATHS: >- + ["Cargo.toml", "Cargo.lock", "rust-toolchain.toml", ".cargo/**", + "pnpm-lock.yaml", "pnpm-workspace.yaml", "package.json", "easytier/**", + "easytier-core/**", "easytier-proto/**", "easytier-rpc-build/**", + "easytier-gui/**", "tauri-plugin-vpnservice/**", + "easytier-web/frontend-lib/**", ".github/workflows/gui.yml", + ".github/actions/**"] outputs: - should_skip: ${{ steps.skip_check.outputs.should_skip == 'true' && !startsWith(github.ref_name, 'releases/') }} + # Release builds must run even if they only change release metadata. + should_skip: >- + ${{ + ( + steps.skip_check.outputs.should_skip == 'true' || + ( + github.event_name == 'pull_request' && + steps.path_filter.outputs.relevant != 'true' + ) + ) && + !startsWith(github.ref_name, 'releases/') + }} steps: - id: skip_check uses: fkirc/skip-duplicate-actions@v5 with: - # All of these options are optional, so you can remove them if you are happy with the defaults concurrent_skipping: 'same_content_newer' skip_after_successful_duplicate: 'true' cancel_others: 'true' - paths: '["Cargo.toml", "Cargo.lock", "easytier/**", "easytier-core/**", "easytier-gui/**", ".github/workflows/gui.yml", ".github/actions/**", "easytier-web/frontend-lib/**"]' + paths: ${{ env.RELEVANT_PATHS }} + + - id: path_filter + if: >- + github.event_name == 'pull_request' && + steps.skip_check.outputs.should_skip != 'true' + uses: dorny/paths-filter@v4 + with: + filters: | + relevant: ${{ env.RELEVANT_PATHS }} + build-gui: strategy: fail-fast: true diff --git a/.github/workflows/mobile.yml b/.github/workflows/mobile.yml index 1eb5a069..aa785b6f 100644 --- a/.github/workflows/mobile.yml +++ b/.github/workflows/mobile.yml @@ -21,21 +21,47 @@ defaults: jobs: pre_job: - # continue-on-error: true # Uncomment once integration is finished runs-on: ubuntu-latest if: github.event_name != 'pull_request' || !github.event.pull_request.draft - # Map a step output to a job output + env: + RELEVANT_PATHS: >- + ["Cargo.toml", "Cargo.lock", "rust-toolchain.toml", ".cargo/**", + "pnpm-lock.yaml", "pnpm-workspace.yaml", "package.json", "easytier/**", + "easytier-core/**", "easytier-proto/**", "easytier-rpc-build/**", + "easytier-gui/**", "tauri-plugin-vpnservice/**", + "easytier-web/frontend-lib/**", ".github/workflows/mobile.yml", + ".github/actions/**"] outputs: - should_skip: ${{ steps.skip_check.outputs.should_skip == 'true' && !startsWith(github.ref_name, 'releases/') }} + # Release builds must run even if they only change release metadata. + should_skip: >- + ${{ + ( + steps.skip_check.outputs.should_skip == 'true' || + ( + github.event_name == 'pull_request' && + steps.path_filter.outputs.relevant != 'true' + ) + ) && + !startsWith(github.ref_name, 'releases/') + }} steps: - id: skip_check uses: fkirc/skip-duplicate-actions@v5 with: - # All of these options are optional, so you can remove them if you are happy with the defaults concurrent_skipping: 'same_content_newer' skip_after_successful_duplicate: 'true' cancel_others: 'true' - paths: '["Cargo.toml", "Cargo.lock", "easytier/**", "easytier-core/**", "easytier-gui/**", "tauri-plugin-vpnservice/**", ".github/workflows/mobile.yml", ".github/actions/**"]' + paths: ${{ env.RELEVANT_PATHS }} + + - id: path_filter + if: >- + github.event_name == 'pull_request' && + steps.skip_check.outputs.should_skip != 'true' + uses: dorny/paths-filter@v4 + with: + filters: | + relevant: ${{ env.RELEVANT_PATHS }} + build-mobile: strategy: fail-fast: true diff --git a/.github/workflows/ohos.yml b/.github/workflows/ohos.yml index 9a4a5db5..6d5eacee 100644 --- a/.github/workflows/ohos.yml +++ b/.github/workflows/ohos.yml @@ -9,6 +9,18 @@ on: pull_request: branches: [develop, main, "ohos/**"] types: [opened, synchronize, reopened, ready_for_review] + paths: + - "Cargo.toml" + - "Cargo.lock" + - "rust-toolchain.toml" + - ".cargo/**" + - "easytier/**" + - "easytier-core/**" + - "easytier-proto/**" + - "easytier-rpc-build/**" + - "easytier-contrib/easytier-ohrs/**" + - ".github/workflows/ohos.yml" + - ".github/actions/**" workflow_dispatch: inputs: publish: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index a6713565..19388d28 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -22,19 +22,40 @@ defaults: jobs: pre_job: - # continue-on-error: true # Uncomment once integration is finished runs-on: ubuntu-latest - # Map a step output to a job output + env: + RELEVANT_PATHS: >- + ["Cargo.toml", "Cargo.lock", "rust-toolchain.toml", ".cargo/**", + "pnpm-lock.yaml", "pnpm-workspace.yaml", "package.json", "easytier/**", + "easytier-core/**", "easytier-proto/**", "easytier-rpc-build/**", + "easytier-web/**", "easytier-gui/src-tauri/**", + "tauri-plugin-vpnservice/**", "easytier-contrib/**", + ".github/workflows/test.yml", ".github/actions/**"] outputs: - should_skip: ${{ steps.skip_check.outputs.should_skip }} + should_skip: >- + ${{ + steps.skip_check.outputs.should_skip == 'true' || + ( + github.event_name == 'pull_request' && + steps.path_filter.outputs.relevant != 'true' + ) + }} steps: - id: skip_check uses: fkirc/skip-duplicate-actions@v5 with: - # All of these options are optional, so you can remove them if you are happy with the defaults concurrent_skipping: 'never' skip_after_successful_duplicate: 'true' - paths: '["Cargo.toml", "Cargo.lock", "easytier/**", "easytier-core/**", "easytier-proto/**", "easytier-web/**", "easytier-gui/src-tauri/**", "easytier-contrib/**", ".github/workflows/test.yml", ".github/actions/**"]' + paths: ${{ env.RELEVANT_PATHS }} + + - id: path_filter + if: >- + github.event_name == 'pull_request' && + steps.skip_check.outputs.should_skip != 'true' + uses: dorny/paths-filter@v4 + with: + filters: | + relevant: ${{ env.RELEVANT_PATHS }} check: name: Run linters & check diff --git a/README.md b/README.md index 9754b6bc..7acfdc68 100644 --- a/README.md +++ b/README.md @@ -300,6 +300,12 @@ sudo easytier-core --network-name mysharednode --network-secret mysharednode EasyTier is released under the [LGPL-3.0](https://github.com/EasyTier/EasyTier/blob/main/LICENSE). +## Responsible Use + +Use EasyTier only for lawful purposes and in compliance with applicable laws +and regulations. You are responsible for ensuring that you are authorized to +connect to and administer the networks and devices involved. + ## Sponsor CDN acceleration and security protection for this project are sponsored by Tencent EdgeOne. diff --git a/README_CN.md b/README_CN.md index 2e2011ee..5898da21 100644 --- a/README_CN.md +++ b/README_CN.md @@ -299,6 +299,10 @@ sudo easytier-core --network-name mysharednode --network-secret mysharednode EasyTier 在 [LGPL-3.0](https://github.com/EasyTier/EasyTier/blob/main/LICENSE) 许可下发布。 +## 使用规范 + +请仅将 EasyTier 用于合法用途，并遵守适用的法律法规。使用者有责任确保其已获授权连接和管理相关网络与设备。 + ## 赞助 本项目的 CDN 加速和安全防护由腾讯云 EdgeOne 赞助。