Fedora Security SIG

The Fedora Security SIG exists to advocate for security across the Fedora userbase and contributor ecosystem. It aims to embed a security conscious mindset into the community and collect best practices for secure usage of Fedora and its downstreams.

With the experiences made during the XZUtils incident of 2024, the Security SIG has been founded to fill a gap: it aims to act as point of exchange, to create and transfer knowledge with a security filter enabled. This allows to make people talk who would not talk otherwise, and connect SIGs and teams who would not be connected otherwise: maximizing the likelihood that the knowledge that is necessary at a given place will end up there on time, and that it has been filtered for security issues that might not always be obvious until it is too late.

The Security SIG complements but does not replace Red Hat Product Security, but it replaces the preceding Security Team.

The Security SIG has integrated security related SIG as Sub-SIG, such as the Confined Users SIG.

The SIG has already contributed to review and updating Docs for security issues and helped to update them. This included an emphasis on cryptography topics, which is a topic that is aimed to be more actively pursued in future.