2

I just read in drupal.org site this comment:

A user who doesn't have the vetted role cannot become the only maintainer, or the project maintainer, of a project that opted into security coverage, in the same way a user without the vetted role cannot take over a project that opted into security coverage.

I tried to found what is this on the site without luck and I really don't have an idea.

Does somebody know what means vetted role in drupal.org?

  • In literal terms, it means that someone has critiqued the person's ability to write secure code. Are you looking for more of a specific explanation of what that process involves? – Clive Sep 23 '20 at 14:36
  • 1
    @leymannx check the link I added to the question – Adrian Cid Almaguer Sep 23 '20 at 18:23
  • 1
    Thank you Adrian, that makes it clearer. – leymannx Sep 23 '20 at 18:30
  • 2
    Oh, that's a comment I wrote. – kiamlaluno Sep 23 '20 at 18:47
  • 1
    @kiamlaluno yes, and was the first time I saw that term – Adrian Cid Almaguer Sep 23 '20 at 19:08
5

In order for a Drupal contributed module to be eligible to be tagged as a security monitored project, one or more of the maintainers have to be 'vetted'.

Here is the main Drupal security policy on this. See the "Which Projects are covered" section. There is a link in this to the process of becoming 'vetted'.

Basically, you submit a Drupal.org project to a queue. Eventually, security community members will review it for use of best security practices, code quality, and some other stuff. If approved, the maintainer becomes 'vetted'. Unfortunately, this process can take a long time to happen.

Once you have a project approved and are 'vetted', any other projects you maintain can be labeled as covered by the security community.

  • This process is new? I never passed the process and I maintain many modules. – Adrian Cid Almaguer Sep 23 '20 at 18:24
  • 1
    It usually doesn't take that long anymore nowadays. The queue has been worked on pretty actively by the community. – leymannx Sep 23 '20 at 18:27
  • 2
    The vetting process is has been around for a LONG time. This one is the modified process that was put into place after they changed the contrib rules to allow anyone to create a full project. The vetting process before that was used to determine if you were allowed to create a full project and not just a sandbox project. – CG Monroe Sep 23 '20 at 20:22
3

I used the term vetted role because vetted is the term that appears in the user profile, to users that on Drupal.org have the Git administrator role.

screenshot

In places listing the possible roles Drupal.org can have, Git vetted user is one of them.

screenshot

Before the ability of opting into security advisory coverage was introduced, that role allowed users to create a full project; without that role, user were only able to create sandbox projects. That is when the vetted role was introduced.

Nowadays, the documentation speaks of being able to opt into security coverage, for example Apply for permission to opt into security advisory coverage or Security advisory process and permissions policy. The term vetted is still mentioned in those pages, but in Security advisory process and permissions policy it appears only once. (It's probable that most users would not catch what vetted means, nor they will notice that term.)

Today, users who want to apply to opt into security coverage for the projects they create are the ones going to get the vetted role. Those aren't the only users who have that role, though. The vetted role has been given to:

  • Users who have asked for the permission to be able to create full project (and not only sandbox projects). Now every user, even the ones who don't have the confirmed role, can create full projects, but they still need the vetted role to opt into security coverage for the projects they create.

  • Users who in the past asked for the permission to commit code into the Drupal.org CVS repository. Now Drupal.org uses Git (in particular an instance of Gitlab running on a drupal.org sub-domain), but the users who asked to be able to write in the Drupal.org CVS repository had the vetted role given them.

Disclaimer

I am one of the users who has reviewed the requests to get the vetted role since the time Drupal.org used CVS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.