Repository navigation
Moving from our CNA to OpenJS CNA #1745
Description
As recently announced by OpenJS, they now own their CNA.
I have been talking with @ruddermann over the past month about the possibility of including Node.js in the OpenJS CNA umbrella. As stated by @mcollina in the TSC channel
We are a CNA only as a defensive measure to have the final say. I trust OpenJS to be a good CNA.
I feel it would be great to fold in their CNA as well. Nothing should change from our security release process or in the automation.
Activity
mcollina commentedon May 30, 2025
@RafaelGSS are you sure? How will we request the CVE?
marco-ippolito commentedon May 30, 2025
I'm afraid the whole automation with H1 apis will stop working
mhdawson commentedon May 30, 2025
It really does not cost us much to have our own CNA so I'm not sure its worth making a change immediately. We might see how the foundation manages being a CNA for the other projects for a little while and if we see benefits from what is being done that would help us move over then.
mcollina commentedon May 30, 2025
If so it would be better to start issuing our own CVEs instead of relying on H1.
marco-ippolito commentedon May 30, 2025
I'd be cautious with changing CNA, I'd wait a few months and figure out a few things (also technical details like how to automate the cve lifecycle).
There is no rush for us so I'm in favor of moving but not right now
ruddermann commentedon Jun 4, 2025
Sorry if there was confusion on this, but being in the OpenJS CNA's scope doesn't force you to stop using the H1 API. You're already in the scope of your own CNA and using the H1 API.
The OpenJS CNA will soon have an API token to request CVE IDs and publish/update those CVEs IDs and there are standard tools like cvelib from Red Hat that the CNA can use to automate and control the entire end-to-end CVE process.
Y'all have a lot of experience with this kind of automation already. It'd be awesome to have Node.js folks advise on this so the OpenJS CNA can provide a service that is easy and straightforward for you to leverage. But it is not a requirement to be under the OpenJS CNA.
RafaelGSS commentedon Jun 12, 2025
@ruddermann, what would we need to do in order to be in the OpenJS CNA scope? Can we keep using HackerOne and its API?
Meanwhile, I leave this issue open, but remove it from the TSC agenda so we can discuss it asynchronously.
jasnell commentedon Jul 18, 2025
Are there concrete next steps here or is this left open just to allow for discussion? It's not clear.
RafaelGSS commentedon Jul 21, 2025
We are still discussing it on the OpenJS Security Collab space. I'll bring more details once I have them.
jasnell commentedon Mar 25, 2026
Still no concrete updates here?
RafaelGSS commentedon Mar 25, 2026
Not really. The OpenJS CNA exists (I'm part of it), but we didn't feel the need to move it. At the moment, holding our own CNA didn't create any issues, considering the CVE request is being handled by H1.