SECURITY.md refresh

[lsm5]

1. The current SECURITY.md points to a project that has been archived.
2. Also, I think pointing to security@lists.podman.io is probably not a good idea for the toolbox project, as it'll be the podman maintainers receiving toolbox issues.

Could you please update the doc here likewise?

[lsm5]

@debarshiray PTAL

[debarshiray]

Thanks for the heads-up, @lsm5 !

1. The current SECURITY.md points to a project that has been archived.

I took care of this immediate short-term issue through pull request #1765

2. Also, I think pointing to security@lists.podman.io is probably not a good idea for the toolbox project, as it'll be the podman maintainers receiving toolbox issues.

Are you folks receiving a lot of traffic concerning Toolbx at security@lists.podman.io? The website also lists press@lists.podman.io and (indirectly) codeofconduct@lists.podman.io.

I am open to making changes because I don't want to needlessly burden you folks.

All the security issues that have affected Toolbx so far have been in the Go dependencies, and none in the Toolbx code itself. So, I have only received notifications through GitHub's security advisory and downstream reports. I have never received anything regarding the code of conduct or at the press contact.

The problem is that I don't know how to make the change. None of the other upstreams I am closely involved with (ie., Fedora and GNOME) are a good fit.

Historically, the CODE-OF-CONDUCT.md (commit, PR) and SECURITY.md (commit, PR) were added by @TomSweeneyRedHat with the blessings of @rhatdan after Toolbx was moved under the Containers organization on GitHub. This made sense to me because (a) it would have been odd to have a project that didn't follow these policies implemented by the organization for no real reason and (b) I didn't want to create or maintain a separate code of conduct and security disclosure mechanism.

The situation changed a bit last year when Podman adopted the Cloud Native Computing Foundation's code of conduct.

I randomly checked out a few other Containers projects that aren't or didn't look tightly related to Podman for inspiration, and found that some are similar to Toolbx and some aren't.

These use the CODE-OF-CONDUCT.md and SECURITY.md from the Containers organization like Toolbx:

• bubblewarp CODE-OF-CONDUCT.md, SECURITY.md
• libtrust CODE-OF-CONDUCT.md, SECURITY.md
• tar-diff CODE-OF-CONDUCT.md, SECURITY.md

This one uses the CODE-OF-CONDUCT.md and not the SECURITY.md:

• ramalama CODE-OF-CONDUCT.md, SECURITY.md

These have neither a CODE-OF-CONDUCT.md nor a SECURITY.md:

• conmon-rs
• containrs
• initoverlayfs
• luksy
• zstd-chunked-rs