From 32a1561a8b5b2f8d860fa4d3d7ed861f0c3dcb6e Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Sun, 19 Oct 2025 11:55:38 +0200 Subject: [PATCH] pkgs/README: clarify active committer role for browsers A small carification of what "active committer" actually means for security-critical, fast-moving packages. --- pkgs/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/README.md b/pkgs/README.md index 55c28934440f..4118b92c2e14 100644 --- a/pkgs/README.md +++ b/pkgs/README.md @@ -58,7 +58,7 @@ Because entries in the Nix store are inert and do nothing by themselves, package For example: * Any package which does not follow upstream security policies should be considered vulnerable. In particular, packages that vendor or fork web engines like Blink, Gecko or Webkit need to keep up with the frequent updates of those projects. - * Any security-critical fast-moving package such as Chrome or Firefox (or their forks) must have at least one active committer among the maintainers. + * Any security-critical fast-moving package such as Chrome or Firefox (or their forks) must have at least one committer among the maintainers, who actively reviews, merges and backports updates. This ensures no critical fixes are delayed unnecessarily, endangering unsuspecting users. * Services which typically work on web traffic are working on untrusted input. * Data (such as archives or rich documents) commonly shared over untrusted channels (e.g. email) is untrusted.