From 66e226d134640240e42a8edd990aabcf98c909d5 Mon Sep 17 00:00:00 2001 From: Kobi Hikri Date: Tue, 14 Jul 2026 16:04:47 +0300 Subject: [PATCH 1/2] Add RFC 9116 security.txt to static/.well-known/ Adds a machine-discoverable security contact at /.well-known/security.txt, served by Hugo from static/. Points to the existing security mailbox (security@lists.valkey.io) and the project's security policy. Includes the RFC 9116-mandatory Expires field. Assisted by an AI tool; every line verified by me against the live site and SECURITY.md. Signed-off-by: Kobi Hikri --- static/.well-known/security.txt | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 static/.well-known/security.txt diff --git a/static/.well-known/security.txt b/static/.well-known/security.txt new file mode 100644 index 00000000..0c6c53cd --- /dev/null +++ b/static/.well-known/security.txt @@ -0,0 +1,6 @@ +# Valkey security contact — see https://github.com/valkey-io/valkey/security/policy +Contact: mailto:security@lists.valkey.io +Expires: 2027-07-14T00:00:00.000Z +Preferred-Languages: en +Canonical: https://valkey.io/.well-known/security.txt +Policy: https://github.com/valkey-io/valkey/security/policy From 8ba67215772dc78a0e841cc96cfb3fb6f5ded470 Mon Sep 17 00:00:00 2001 From: Kobi Hikri Date: Sun, 26 Jul 2026 08:04:20 +0300 Subject: [PATCH 2/2] Generate security.txt at build time so Expires never goes stale Per review: derive the RFC 9116 Expires field from the build rather than committing a fixed date, so it always sits one year past the last site build. - add build/init-security-txt.sh, following the existing build/ script style - call it from the same workflow step as init-topics-and-clients and init-commands - gitignore the generated file, matching how content/commands and content/topics are handled Signed-off-by: Kobi Hikri --- .github/workflows/zola-deploy.yml | 3 ++- .gitignore | 1 + build/init-security-txt.sh | 42 +++++++++++++++++++++++++++++++ static/.well-known/security.txt | 6 ----- 4 files changed, 45 insertions(+), 7 deletions(-) create mode 100755 build/init-security-txt.sh delete mode 100644 static/.well-known/security.txt diff --git a/.github/workflows/zola-deploy.yml b/.github/workflows/zola-deploy.yml index 9e39ec3d..192ce0cf 100644 --- a/.github/workflows/zola-deploy.yml +++ b/.github/workflows/zola-deploy.yml @@ -54,7 +54,7 @@ jobs: repository: valkey-io/valkey-json path: valkey-json - - name: Init commands, topics and clients + - name: Init commands, topics, clients and security.txt run: | cd website ./build/init-topics-and-clients.sh ../valkey-doc/topics \ @@ -62,6 +62,7 @@ jobs: ./build/init-commands.sh ../valkey-doc/commands \ ../valkey/src/commands ../valkey-bloom/src/commands \ ../valkey-json/src/commands ../valkey-search/src/commands + ./build/init-security-txt.sh . - name: Build only uses: shalzz/zola-deploy-action@v0.22.0 diff --git a/.gitignore b/.gitignore index e9aeccba..8fa6502e 100644 --- a/.gitignore +++ b/.gitignore @@ -21,3 +21,4 @@ _data/modules.json .idea/* tmp/* static/debug +static/.well-known/security.txt diff --git a/build/init-security-txt.sh b/build/init-security-txt.sh new file mode 100755 index 00000000..37989a71 --- /dev/null +++ b/build/init-security-txt.sh @@ -0,0 +1,42 @@ +#!/bin/bash +# See README for usage +# This file will generate static/.well-known/security.txt (RFC 9116). +# +# The Expires field is derived from the build date rather than committed, so it +# always sits one year past the last site build and cannot silently go stale. + +# first check to make sure there are arguments +if [ -z "$1" ]; then + echo "You must supply a path to the site root as the first argument" + exit 1 +fi + +# check for validity of this argument as a path +if [ ! -d "$1" ]; then + echo "The site root must exist and be a valid path" + exit 1 +fi + +SITE_ROOT="$1" +WELL_KNOWN="${SITE_ROOT}/static/.well-known" + +# one year past this build, in the RFC 3339 form RFC 9116 requires +if date -u -d '+1 year' >/dev/null 2>&1; then + EXPIRES=$(date -u -d '+1 year' +%Y-%m-%dT%H:%M:%SZ) # GNU date +else + EXPIRES=$(date -u -v+1y +%Y-%m-%dT%H:%M:%SZ) # BSD date +fi + +mkdir -p "$WELL_KNOWN" + +cat > "${WELL_KNOWN}/security.txt" <