Document process for 'security-fix' releases
Change-Id: Ie3a99ac2dc2573091dc21156ca1643c0867ba61d
Signed-off-by: Edwin Kempin <edwin.kempin@sap.com>
diff --git a/Documentation/dev-release.txt b/Documentation/dev-release.txt
index 7a963fc..b352ca4 100644
--- a/Documentation/dev-release.txt
+++ b/Documentation/dev-release.txt
@@ -60,6 +60,24 @@
objectives are met
+Security-Fix
+~~~~~~~~~~~~
+
+`security-fix` releases should only contain bug fixes for security
+issues.
+
+For security issues it is important that they are only announced
+*after* fixed versions for all relevant releases have been published.
+Because of this `security-fix` releases can't be prepared in the public
+`gerrit` project.
+
+`security-fix` releases are prepared in the `gerrit-security-fixes`
+project which is only readable by the Gerrit Maintainers. Only after
+a `security-fix` release has been published the commits/tags done in
+the `gerrit-security-fixes` project will be taken over into the public
+`gerrit` project.
+
+
Create the Actual Release
---------------------------
