Skip to content

Commit dbc08a0

Browse files
committed
TCR-584 corrections
1 parent 7f86ba3 commit dbc08a0

File tree

1 file changed

+20
-12
lines changed

1 file changed

+20
-12
lines changed

docs/els-for-languages/README.md

Lines changed: 20 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
# Endless Lifecycle Support for Languages
22

3-
* [ELS for PHP](./#els-for-php/)
4-
* [ELS for Python](./#els-for-python/)
5-
* [ELS for Spring Framework and Spring Boot](./##els-for-spring-framework-and-spring-boot/)
6-
* [ELS for .NET](./#endless-lifecycle-support-for-net-6/)
3+
* [ELS for PHP](./#els-for-php)
4+
* [ELS for Python](./#els-for-python)
5+
* [ELS for Spring Framework and Spring Boot](./#els-for-spring-framework-and-spring-boot)
6+
* [ELS for .NET](./#endless-lifecycle-support-for-net-6)
77

88
## ELS for PHP
99

@@ -341,10 +341,11 @@ You need username and password in order to use TuxCare ELS Spring repository. An
341341

342342
### Step 2: Create or Modify Your Build Tool Settings
343343

344-
Maven
344+
**Maven**
345345

346346
If you are using Maven as your build automation tool, you will need to make changes in your `${MAVEN_HOME}/settings.xml` file. If the file does not already exist in your Maven home directory (`${MAVEN_HOME}`), you should create one. Open the `settings.xml` file with a text editor and include the following configuration:
347347

348+
```
348349
<?xml version="1.0" encoding="UTF-8"?>
349350
<settings xmlns="http://maven.apache.org/SETTINGS/1.1.0">
350351
<servers>
@@ -354,30 +355,36 @@ If you are using Maven as your build automation tool, you will need to make chan
354355
<password>${env.PASSWORD}</password>
355356
</server>
356357
</servers>
357-
</settings>
358+
</settings>
359+
```
358360

359361
Set your credentials via the following enviromnent variables:
360362

363+
```
361364
export USERNAME=your-username
362365
export PASSWORD=your-password
366+
```
363367

364368
Here `your-username` and `your-password` are your credentials mentioned in the [Step 1](https://github.com/cloudlinux/securechain-java/blob/main/details/integration_guide.md#step-1-get-user-credntials) .
365369

366370
You may choose an arbitrary allowed value instead of `repository-id` and use the same value in the following snippet from your `pom.xml` file:
367371

372+
```
368373
<repositories>
369374
<repository>
370375
<id>repository-id</id>
371376
<url>https://nexus-repo.corp.cloudlinux.com/repository/els_spring/</url>
372377
</repository>
373378
</repositories>
379+
```
374380

375381
An example of maven project you can find [here](https://github.com/cloudlinux/securechain-java/blob/main/examples/maven) . Do not forget to set the enviromnet variables.
376382

377-
Gradle
383+
**Gradle**
378384

379385
If you are using Gradle as your build automation tool, make sure to include the following configuration in your project setup:
380386

387+
```
381388
repositories {
382389
maven {
383390
url = uri("https://nexus-repo.corp.cloudlinux.com/repository/els_spring")
@@ -387,6 +394,7 @@ If you are using Gradle as your build automation tool, make sure to include the
387394
}
388395
}
389396
}
397+
```
390398

391399
Set your credentials via the following enviromnent variables:
392400

@@ -1828,11 +1836,11 @@ You've successfully integrated the TuxCare ELS for Spring repository into your p
18281836
| CVE-2023-5685 | HIGH | org.springframework.boot | spring-boot-starter-undertow | 2.7.18 |
18291837

18301838

1831-
### Endless Lifecycle Support for .NET 6
1839+
## Endless Lifecycle Support for .NET 6
18321840

18331841
Endless Lifecycle Support (ELS) for .NET 6 from TuxCare provides security fixes for .NET 6 that has reached its end of life. This allows you to continue running .NET 6 applications without vulnerability concerns, even after official support has ended.
18341842

1835-
#### Vulnerability Coverage and Target Response Times
1843+
### Vulnerability Coverage and Target Response Times
18361844

18371845
TuxCare employs the Common Vulnerability Scoring System (CVSS v3) to assess the severity of security vulnerabilities. Our severity rating system for patching vulnerabilities integrates both NVD scoring and vendor scoring (when available). When the vendor's score is lower than the NVD score, we prioritize the NVD score.
18381846

@@ -1844,15 +1852,15 @@ TuxCare will make commercially reasonable efforts to adhere to the following gui
18441852
* **Low-severity CVEs**: Patches may be provided upon custom request
18451853
* TuxCare may offer a mitigation strategy as an alternative to a direct code fix.
18461854

1847-
#### Incident Reporting and Response Timeframe
1855+
### Incident Reporting and Response Timeframe
18481856

18491857
Customers can report vulnerabilities by submitting a ticket through the TuxCare Support Portal [https://tuxcare.com/support-portal/](https://tuxcare.com/support-portal/). TuxCare commits to providing an initial response to any reported issue within 3 days.
18501858

18511859
Requests for customer-directed security patches for CVEs that are outside of the ELS for .NET scope will be reviewed within 3 working days. If the request is accepted, we will provide the patch within the next 60 days.
18521860

18531861
Handling Multiple Vulnerabilities: In cases where several CVEs are reported simultaneously for fixing, TuxCare will discuss and agree upon resolution timelines separately with the customer.
18541862

1855-
#### Enhanced Transparency & Visibility
1863+
### Enhanced Transparency & Visibility
18561864

18571865
TuxCare's commitment to transparency and visibility is foundational to our ELS for .NET offering. We aim to provide comprehensive details about how each package is built, verified, and distributed, ensuring complete trust in the software supply chain.
18581866

@@ -1861,7 +1869,7 @@ TuxCare's commitment to transparency and visibility is foundational to our ELS f
18611869
* **Verifiable Integrity and Provenance**: Our packages and metadata provide comprehensive end-to-end provenance, detailing how each package was constructed and tested, ensuring that all components in your software stack are trustworthy. _Note: Availability is planned for Q2 2025_.
18621870
* **Secure Distribution**: Signed versions of the packages and their metadata are distributed from a registry managed, secured, and protected by TuxCare, guaranteeing that your software updates are authentic and untampered.
18631871

1864-
#### Technical Support
1872+
### Technical Support
18651873

18661874
TuxCare provides technical support according to the [support policy](https://tuxcare.com/TuxCare-support-policy.pdf). It delivers 24/7/365 access to the TuxCare’s support team through the TuxCare Support Portal [https://tuxcare.com/support-portal/](https://tuxcare.com/support-portal/) and to the TuxCare’s online knowledge base.
18671875

0 commit comments

Comments
 (0)