[PATCH 1/2] advisories: Document rejection process in README.

[Siddhesh Poyarekar]

On 21/04/2026 12:43, Carlos O'Donell wrote:
> ---
>   advisories/README | 15 +++++++++++++++
>   1 file changed, 15 insertions(+)
> 
> diff --git a/advisories/README b/advisories/README
> index b8f8a829ca..330a31dff3 100644
> --- a/advisories/README
> +++ b/advisories/README
> @@ -25,6 +25,10 @@ This is the CVE-Id assigned under the CVE Program
>   Public-Date:
>   The date this issue became publicly known.
>   
> +Rejected-Date:
> +The most recent date the assigned advisory was rejected. If the advisory
> +is ever published again the Rejected-Date tag should be removed.
> +
>   Vulnerable-Commit:
>   The commit that introduced this vulnerability.  There could be multiple
>   entries, one for each release branch in the glibc repository; the
> @@ -67,6 +71,17 @@ An advisory for a CVE needs to be added on the master branch in two steps:
>   
>   4. Verify the updated advisory and push the result.
>   
> +Rejecting an Advisory
> +---------------------
> +
> +Rejecting an advisory on the master branch can be done in one step:
> +
> +1. Mark the advisory as rejected. Add the text "REJECTED: " as a prefix
> +   to any short-form description. Add a new paragraph that starts with
> +   "REJECTED: " and explains the reason for the rejection including
> +   justification for why it no longer has security impact.  Lastly add
> +   a Rejected-Date tag to the advisory.
> +
>   Getting a NEWS snippet from advisories
>   --------------------------------------
>   

LGTM.

Reviewed-by: Siddhesh Poyarekar <siddhesh@gotplt.org>