All required fields are included in the parent Issue: https://www.drupal.org/project/projectapplications/issues/2867474


I finished the theme in 2017 and I created an issue for the security advisory coverage. It was fixed and closed but I did not get the covered by the security advisory policy I tested the theme for Drupal 9 beta 2 and it is ready. I would like to have the security advisory badge on the theme.

How do I get the covered by the security advisory policy for my theme? Please help.

CommentFileSizeAuthor
#3 sec-covered.png44.86 KBflashwebcenter

Comments

flashwebcenter created an issue. See original summary.

avpaderno’s picture

Title: Child Issue for [D8] Drupal8 W3CSS Theme » How do I opt into security coverage for my theme?
Project: Drupal.org security advisory coverage applications » Drupal.org site moderators
Component: theme » Other
Category: Task » Support request
Status: Needs review » Fixed
Parent issue: #2867474: [D8] Drupal8 W3CSS Theme »

You need to edit the theme (https://www.drupal.org/node/2866094/edit) and select Opt into security advisory coverage, under Security advisory coverage, right after Development status.
Applications to be able to opt into security coverage just give to the users the Drupal role that allows them to edit their projects and be able to opt into security coverage; they don't change the status of the project, which needs to be changed from the project owner.

flashwebcenter’s picture

StatusFileSize
new44.86 KB

Thank you for your help. I don't have the permissions to select Opt into security advisory coverage, under Security advisory coverage, right after Development status. It is disabled.


screen shot


According to this page one-time review process I should be able to mark my project. Please help.

flashwebcenter’s picture

Status: Fixed » Active
gisle’s picture

kiamlaluno,
if I am not mistaken, flashwebcenter was never given the permission to opt into security coverage. So he/she shall not be able to do what you suggest in comment #2.

flashwebcenter
when looking at your application to opt into security coverage - #2867474: [D8] Drupal8 W3CSS Theme, I think you closed it prematurely, i.e. before it was approved by a git administrator. I try to describe the two mistakes you did below:

  1. In comment #22 you changed its status to "Fixed". This was a mistake #1. You never set the status of an application to "Fixed" yourself. You always wait for a git administrator to do it. You had not yet been given the permission to opt into security at that point, so nothing was really "Fixed". You should have let the application remain with status RTBC until a git admin had checked it and either bumped it back to "Needs work", or given you the permission.
  2. However, this small mistake would normally have been spotted and corrected. But in the next comment #23, you again changed its status to "Closed (fixed)". This was a big mistake. It removed your application from the list of open issues, so your first small mistake could no longer be spotted and corrected.

To conclude, looking at how your application progressed, it was never really "Fixed", since setting this status yourself accomplishes nothing. You still don't have permission to opt into security coverage, and that is why that radio button is still greyed out in your profile.

How do I get the covered by the security advisory policy for my theme?

You need to be given the permission to opt into security advisories by a git administrator: You can do this either by getting your two year old application reopened (with status set to RTBC), or by starting a new one.

Before doing so, it may be a good idea to read about Issue Queue Etiquette. Pay special attention to recital #11.

neerajsingh’s picture

Hi flashwebcenter,
Your user account does not have access to opt into security advisory coverage. This is provided by Git administrators, for more refer: https://www.drupal.org/node/1125818 .

You also need to check out the workflow to achieve this access: https://www.drupal.org/node/539608 .

Additionally, guidance from gisle in the comments above has detailed out the further todos.

avpaderno’s picture

Status: Active » Fixed

@gisle Yes, I noticed. I am closing this as fixed and re-opening the application, which has never been approved (nor has reached the Reviewed & tested by the community point).

gisle’s picture

(nor has reached the Reviewed & tested by the community point).

Yes, it did (in comment #18) - https://www.drupal.org/project/projectapplications/issues/2867474#commen... - however, that was a pretty shallow review, so "Needs review" is probably the right status.

flashwebcenter’s picture

Thank you kiamlaluno, neerajsingh, and gisle for your help. We learn from mistakes. Maybe we can have some custom code to disable "fixed" and "closed fixed" for any maintainer in the project. It will save time for drupal.org webmasters and prevent any project maintainer to do the same mistake.
Again thank you all for your help, and be save.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.