Merge tag 'efi-2023-01-rc1-4' of https://source.denx.de/u-boot/custodians/u-boot-efi

Pull request for efi-2023-01-rc1-4

Documentation:

* Provide a document about security issue handling.

UEFI:

* Let networking support depend on NETDEVICES.
* Discover if no efi_system_partition is set.

Other:

* MAINTAINERS: add arch/arm/lib/*_efi.* to EFI_PAYLOAD.

1 files changed, 32 insertions, 0 deletions

diff --git a/doc/develop/security.rst b/doc/develop/security.rst
new file mode 100644
index 00000000000..84b130646f3
--- /dev/null
+++ b/doc/develop/security.rst
@@ -0,0 +1,32 @@
+.. SPDX-License-Identifier: GPL-2.0+:
+
+Handling of security vulnerabilities
+====================================
+
+The U-Boot project takes security very seriously.  As such, we'd like to know
+when a security bug is found so that it can be fixed and disclosed as quickly
+as possible.
+
+Contact
+-------
+
+The preferred initial point of contact is to send email to
+`u-boot@lists.denx.de` and use `scripts/get_maintainers.pl` to also include any
+relevant custodians. In addition, Tom Rini should be contacted at
+`trini@konsulko.com`.
+
+CVE assignment
+--------------
+
+The U-Boot project cannot directly assign CVEs, nor do we require them for
+reports or fixes, as this can needlessly complicate the process and may delay
+the bug handling. If a reporter wishes to have a CVE identifier assigned ahead
+of public disclosure, they will need to coordinate this on their own.  When
+such a CVE identifier is known before a patch is provided, it is desirable to
+mention it in the commit message if the reporter agrees.
+
+Non-disclosure agreements
+-------------------------
+
+The U-Boot project is not a formal body and therefore unable to enter any
+non-disclosure agreements.