User:Pfrields/Critical security update SOP

This needs to be de-duped against the already existing Urgent updates policy.

• communications
  • announcement(s) to ML(s)?
  • Fedora Magazine article
• coordination baton holder
  • q.v. CSI docs?
• releng requirements — pushes and stuff
• do we need to respin images?
• do we need to use the urgent-fixes repo?
• infrastructure consuming the fixes early/first
• any package rebuilds needed beyond the flawed one?
  • and do any package _builders_ need to be found?
• coordination of patches - how do we know what to apply
• test cases... two aspects
  • does the package still function right
  • is the flaw fixed
• and getting testers lined up