[dpdk-stable] [PATCH 2/2] README: add a few notes about a security release

[Kevin Traynor]

Signed-off-by: Kevin Traynor <ktraynor at redhat.com>
---
 README | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/README b/README
index a4d7a75..fdf61ab 100644
--- a/README
+++ b/README
@@ -187,4 +187,5 @@ and finally send a patch for the dpdk-web changes to the web team at web at dpdk.or
 
 6-announce-release
+==================
 
 The last step is to announce it. The usage is also simpler: just type the
@@ -194,3 +195,23 @@ too short and simple so far :).
 
 
+
+Security Releases
+=================
+
+Just a reminder any comms to DPDK security team should be over encrypted email.
+
+For releases with embargoed CVEs steps 1/2/3/4 above will be skipped.
+
+Patches will be provided by the DPDK security team. They should be applied
+locally and compile tested locally without using external tools like travis
+that will make the patches public.
+
+For validation notes in step 5, they should be obtained from the author or
+DPDK security team.
+
+In terms of sequence, the main thing is that everyone is ready and available.
+Pushing different tags to the server can be done in series with other stable
+maintainers to avoid any issues with tarball/docs generation. A single website
+update can then be made.
+
 That's all.
-- 
2.21.0