commit a57edaaf08be93b86443f2f840d7ec8c0aed6d19
Author: Neil Drumm <drumm@delocalizedham.com>
Date:   Mon Feb 27 17:36:04 2017 -0500

    wip

diff --git a/core/modules/update/images/shield-icon.svg b/core/modules/update/images/shield-icon.svg
new file mode 100644
index 0000000..9a7c56d
--- /dev/null
+++ b/core/modules/update/images/shield-icon.svg
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   version="1.1"
+   id="svg4167"
+   viewBox="0 0 80.115432 91.337247"
+   height="25.777401mm"
+   width="22.610355mm">
+  <defs
+     id="defs4169" />
+  <metadata
+     id="metadata4172">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title></dc:title>
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     transform="translate(-214.228,-109.55072)"
+     id="layer1">
+    <path
+       style="fill:#333333;fill-rule:evenodd;stroke:#333333;stroke-width:9;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;fill-opacity:1"
+       d="m 255.57537,113.87618 -36.84737,10.57279 0,30.97814 c 0,14.98689 30.61298,40.99562 35.51197,40.96067 l 0.0915,0 c 5.00951,0.0349 35.51196,-25.97378 35.51196,-40.96067 l 0,-30.97814 c -12.25476,-3.52427 -24.50952,-7.04851 -36.76428,-10.57279"
+       id="path4206" />
+  </g>
+</svg>
diff --git a/core/modules/update/src/UpdateProcessor.php b/core/modules/update/src/UpdateProcessor.php
index 25dfc7a..9115357 100644
--- a/core/modules/update/src/UpdateProcessor.php
+++ b/core/modules/update/src/UpdateProcessor.php
@@ -231,6 +231,9 @@ protected function parseXml($raw_xml) {
         foreach ($release->children() as $k => $v) {
           $data['releases'][$version][$k] = (string) $v;
         }
+        if ($release->security['covered']) {
+          $data['releases'][$version]['security_covered'] = TRUE;
+        }
         $data['releases'][$version]['terms'] = [];
         if ($release->terms) {
           foreach ($release->terms->children() as $term) {
diff --git a/core/modules/update/tests/modules/update_test/bbb_update_test.1_0.xml b/core/modules/update/tests/modules/update_test/bbb_update_test.1_0.xml
index 8d705b5..2142c04 100644
--- a/core/modules/update/tests/modules/update_test/bbb_update_test.1_0.xml
+++ b/core/modules/update/tests/modules/update_test/bbb_update_test.1_0.xml
@@ -16,11 +16,11 @@
  <release>
   <name>bbb_update_test 8.x-1.0</name>
   <version>8.x-1.0</version>
-  <tag>DRUPAL-7--1-0</tag>
+  <tag>8.x-1.0</tag>
   <version_major>1</version_major>
   <version_patch>0</version_patch>
   <status>published</status>
-  <release_link>http://example.com/bbb_update_test-7-x-1-0-release</release_link>
+  <release_link>http://example.com/bbb_update_test-8-x-1-0-release</release_link>
   <download_link>http://example.com/bbb_update_test-8.x-1.0.tar.gz</download_link>
   <date>1250424521</date>
   <mdhash>b966255555d9c9b86d480ca08cfaa98e</mdhash>
@@ -29,6 +29,26 @@
    <term><name>Release type</name><value>New features</value></term>
    <term><name>Release type</name><value>Bug fixes</value></term>
   </terms>
+  <security covered="1"/>
+ </release>
+ <release>
+  <name>bbb_update_test 8.x-1.0-beta1</name>
+  <version>8.x-1.0-beta1</version>
+  <tag>8.x-1.0-beta1</tag>
+  <version_major>1</version_major>
+  <version_patch>0</version_patch>
+  <version_extra>beta1</version_extra>
+  <status>published</status>
+  <release_link>http://example.com/bbb_update_test-8-x-1-0-beta1</release_link>
+  <download_link>http://example.com/bbb_update_test-8.x-1.0-beta1.tar.gz</download_link>
+  <date>1250424521</date>
+  <mdhash>7da7b18ce17cef2122f5cbca1bfe626a</mdhash>
+  <filesize>1073751331</filesize>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+  </terms>
+  <security>Not covered!</security>
  </release>
 </releases>
 </project>
diff --git a/core/modules/update/update.module b/core/modules/update/update.module
index 32b5b8c..6b438ee 100644
--- a/core/modules/update/update.module
+++ b/core/modules/update/update.module
@@ -227,7 +227,7 @@ function update_theme() {
     // We are using template instead of '#type' => 'table' here to keep markup
     // out of preprocess and allow for easier changes to markup.
     'update_version' => [
-      'variables' => ['version' => NULL, 'title' => NULL, 'attributes' => []],
+      'variables' => ['version' => NULL, 'title' => NULL, 'security_icon' => NULL, 'attributes' => []],
       'file' => 'update.report.inc',
     ],
   ];
diff --git a/core/modules/update/update.report.inc b/core/modules/update/update.report.inc
index 7b14a05..886071d 100644
--- a/core/modules/update/update.report.inc
+++ b/core/modules/update/update.report.inc
@@ -127,6 +127,14 @@ function template_preprocess_update_project_status(&$variables) {
   $versions_inner = [];
   $security_class = [];
   $version_class = [];
+  $security_icon = [
+    '#theme' => 'image',
+    '#width' => 18,
+    '#height' => 18,
+    '#uri' => 'core/modules/update/images/shield-icon.svg',
+    '#alt' => t('shield'),
+    '#title' => t('shield'),
+  ];
   if (isset($project['recommended'])) {
     if ($project['status'] != UPDATE_CURRENT || $project['existing_version'] !== $project['recommended']) {
 
@@ -160,6 +168,7 @@ function template_preprocess_update_project_status(&$variables) {
           '#theme' => 'update_version',
           '#version' => $project['releases'][$project['recommended']],
           '#title' => t('Recommended version:'),
+          '#security_icon' => $security_icon,
           '#attributes' => ['class' => $version_class],
         ];
       }
@@ -172,6 +181,7 @@ function template_preprocess_update_project_status(&$variables) {
             '#theme' => 'update_version',
             '#version' => $security_update,
             '#title' => t('Security update:'),
+            '#security_icon' => $security_icon,
             '#attributes' => ['class' => $security_class],
           ];
         }
@@ -183,6 +193,7 @@ function template_preprocess_update_project_status(&$variables) {
         '#theme' => 'update_version',
         '#version' => $project['releases'][$project['latest_version']],
         '#title' => t('Latest version:'),
+        '#security_icon' => $security_icon,
         '#attributes' => ['class' => ['version-latest']],
       ];
     }
diff --git a/core/themes/stable/templates/admin/update-version.html.twig b/core/themes/stable/templates/admin/update-version.html.twig
index 6c23584..a02f3d3 100644
--- a/core/themes/stable/templates/admin/update-version.html.twig
+++ b/core/themes/stable/templates/admin/update-version.html.twig
@@ -6,21 +6,33 @@
  * Available variables:
  * - attributes: HTML attributes suitable for a container element.
  * - title: The title of the project.
+ * - security_icon: The security coverage icon.
  * - version:  A list of data about the latest released version, containing:
  *   - version: The version number.
  *   - date: The date of the release.
  *   - download_link: The URL for the downloadable file.
  *   - release_link: The URL for the release notes.
+ *   - security_covered: If the release is covered by the security advisory
+ *     policy.
+ *   - security: When not covered, the reason why.
  */
 #}
 <div class="{{ attributes.class }} project-update__version"{{ attributes|without('class') }}>
   <div class="clearfix">
     <div class="project-update__version-title layout-column layout-column--quarter">{{ title }}</div>
-    <div class="project-update__version-details layout-column layout-column--quarter">
+    <div class="project-update__version-details layout-column layout-column--half">
       <a href="{{ version.release_link }}">{{ version.version }}</a>
       <span class="project-update__version-date">({{ version.date|date('Y-M-d') }})</span>
+      {% if version.security_covered %}
+        <span class="project-update__coverage-icon">
+          <a href="https://www.drupal.org/security-advisory-policy">{{ security_icon }}</a>
+        </span>
+      {% endif %}
+      {% if version.security %}
+        <br>{{ version.security|t }}
+      {% endif %}
     </div>
-    <div class="layout-column layout-column--half">
+    <div class="layout-column layout-column--quarter">
       <ul class="project-update__version-links">
         <li class="project-update__download-link">
           <a href="{{ version.download_link }}">{{ 'Download'|t }}</a>