| The embargo date is computed from the release date of the patched versions. That date is read from the ReleaseNotes.Code.ReleaseNoteClass object of the product. When there is none, the code falls back to checking that the artifact exists in the extension repositories (SPAPP-21) and uses the current date as the release date (DefaultVersionReleasedManager#computeReleased). This fallback applies to every xwiki-contrib extension:
- only XWiki Standard and a few products have release notes in the Release Notes Application;
- the product of an imported GitHub advisory is the repository name (e.g. application-antispam), which doesn't match the release notes product names anyway (e.g. ActivityPub vs application-activitypub).
As a consequence, the embargo of a contrib advisory starts when the "Automatic computation of advisories embargo dates" job first runs after the advisory is announced, not when the fix was released. For example, an advisory announced a few months after the release gets an embargo ending a few months too late, and the result also depends on when the job happens to run. Suggested improvement: when no release note exists, use the actual release date of the patched version, e.g. the date of the artifact in the Maven repository it was resolved from. |
