From ad7e68502abf98158898494c234a97fc282ad985 Mon Sep 17 00:00:00 2001 From: Felipe Zipitria Date: Sun, 11 Feb 2024 13:36:35 -0300 Subject: [PATCH] chore: update versions Signed-off-by: Felipe Zipitria --- .pre-commit-config.yaml | 2 +- README.md | 4 ++-- SECURITY.md | 15 ++++++++------- 3 files changed, 11 insertions(+), 10 deletions(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index c09c810fe..01e1a0fb2 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -9,5 +9,5 @@ repos: args: [--allow-multiple-documents] - id: end-of-file-fixer - id: trailing-whitespace - exclude: '^util/regexp-assemble/' + exclude: '^regex-assembly/' args: [--markdown-linebreak-ext=md] diff --git a/README.md b/README.md index 2b8a0d211..661427423 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ +![GHA build v4.1/dev](https://github.com/coreruleset/coreruleset/workflows/Regression%20Tests/badge.svg?branch=v4.1%2Fdev)
![GHA build v4.0/dev](https://github.com/coreruleset/coreruleset/workflows/Regression%20Tests/badge.svg?branch=v4.0%2Fdev) ![GHA build v3.3/dev](https://github.com/coreruleset/coreruleset/workflows/Regression%20Tests/badge.svg?branch=v3.3%2Fdev) -![GHA build v3.2/dev](https://github.com/coreruleset/coreruleset/workflows/Regression%20Tests/badge.svg?branch=v3.2%2Fdev)
[![OWASP Flagship](https://img.shields.io/badge/owasp-flagship%20project-38a047.svg)](https://owasp.org/projects/) [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/1390/badge)](https://bestpractices.coreinfrastructure.org/projects/1390) [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) @@ -28,6 +28,6 @@ We strive to make the OWASP ModSecurity CRS accessible to a wide audience of beg ## License Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
-Copyright (c) 2021-2023 Core Rule Set project. All rights reserved. +Copyright (c) 2021-2024 Core Rule Set project. All rights reserved. The OWASP ModSecurity Core Rule Set is distributed under Apache Software License (ASL) version 2. Please see the enclosed LICENSE file for full details. diff --git a/SECURITY.md b/SECURITY.md index f33f8d864..fd45a42bc 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -4,15 +4,16 @@ OWASP CRS has two types of releases, Major releases (3.0.0, 3.1.0, 3.2.0 etc.) and point releases (3.0.1, 3.0.2 etc.). For more information see our [wiki](https://github.com/coreruleset/coreruleset/wiki/Release-Policy). + The OWASP CRS officially supports the two latest point releases with severe security patches. We are happy to receive and merge PR's that address security issues in older versions of the project, but the team itself may choose not to fix these. Along those lines, OWASP CRS team may not issue security notifications for unsupported software. | Version | Supported | | --------- | ------------------ | -| 4.0.0-RC1 | :x: | +| 4.0.0 | :white_check_mark: | | 3.3.x | :white_check_mark: | -| 3.2.x | :white_check_mark: | +| 3.2.x | :x: | | 3.1.x | :x: | | 3.0.x | :x: | | 2.x | :x: | @@ -28,17 +29,17 @@ You can also use `gpg --fetch-key https://coreruleset.org/security.asc` directly ### Verifying the CRS Release -Download the release file and the corresponding signature. The following example shows how to do it for `v3.3.2` release: +Download the release file and the corresponding signature. The following example shows how to do it for `v4.0.0` release: ```bash -$ wget https://github.com/coreruleset/coreruleset/archive/refs/tags/v3.3.2.tar.gz -$ wget https://github.com/coreruleset/coreruleset/releases/download/v3.3.2/coreruleset-3.3.2.tar.gz.asc +$ wget https://github.com/coreruleset/coreruleset/archive/refs/tags/v4.0.0.tar.gz +$ wget https://github.com/coreruleset/coreruleset/releases/download/v4.0.0/coreruleset-4.0.0.tar.gz.asc ``` **Verification**: ```bash -❯ gpg --verify coreruleset-3.3.2.tar.gz.asc v3.3.2.tar.gz +❯ gpg --verify coreruleset-4.0.0.tar.gz.asc v4.0.0.tar.gz gpg: Signature made Wed Jun 30 10:05:48 2021 -03 gpg: using RSA key 36006F0E0BA167832158821138EEACA1AB8A6E72 gpg: Good signature from "OWASP Core Rule Set " [unknown] @@ -59,7 +60,7 @@ gpg> quit Then you will see this result when verifying: ```bash -gpg --verify coreruleset-3.3.2.tar.gz.asc v3.3.2.tar.gz +gpg --verify coreruleset-4.0.0.tar.gz.asc v4.0.0.tar.gz gpg: Signature made Wed Jun 30 15:05:48 2021 CEST gpg: using RSA key 36006F0E0BA167832158821138EEACA1AB8A6E72 gpg: Good signature from "OWASP Core Rule Set " [ultimate]