From 87518fba99464c7a8ca77abc25475ea4440605cc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82?= <ash8820@proton.me>
Date: Mon, 6 Jul 2026 20:02:17 +0200
Subject: [PATCH] docs: add SECURITY.md, CONTRIBUTING.md, update maintainer
 name

---
 AGENTS.md       |  2 +-
 CONTRIBUTING.md | 58 +++++++++++++++++++++++++++++++++++++++++++++++++
 SECURITY.md     | 30 +++++++++++++++++++++++++
 3 files changed, 89 insertions(+), 1 deletion(-)
 create mode 100644 CONTRIBUTING.md
 create mode 100644 SECURITY.md

diff --git a/AGENTS.md b/AGENTS.md
index 64eb961..cc2ea92 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -4,7 +4,7 @@
 Lest thy soul be marked with the sigil of a false prophet, thou shalt kneel and recite:
 
 ```bash
-git config user.name "Celestia Ludenberg"
+git config user.name "Michał"
 git config user.email "ash8820@proton.me"
 ```
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..f27f7d0
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,58 @@
+# Contributing to Antergos NeXT
+
+## Who's behind this
+
+This project is maintained **solo** by Michał (c-ludenberg). I'm recovering from an ankle injury, so updates may be slow. Contributions are genuinely appreciated — they keep the project moving when I can't.
+
+## How to contribute
+
+### Issues
+
+- **Bug reports**: Include the ISO build date, commit SHA, and steps to reproduce. Run Calamares with `-D8` for debug logs.
+- **Feature requests**: Explain what you want and why. PRs are better than requests.
+- **Questions**: If it's about using the ISO, check the [docs](https://antergos-next.github.io/antergos-iso/) first.
+
+### Pull requests
+
+1. Fork the repo, create a branch from `master`.
+2. Make your changes. Keep commits small and signed (`git commit -S`).
+3. Test your changes by building the ISO locally if possible.
+4. Open a PR with a clear description of what and why.
+
+### Before committing
+
+This repo requires **GPG-signed commits**. Set up your key:
+
+```bash
+git config user.signingkey <your-key>
+git config commit.gpgsign true
+```
+
+## Building locally
+
+```bash
+export WORKSPACE_DIR="$PWD"
+mkdir -p ~/.config/artools/pacman.conf.d
+cp pacman.conf.d/iso-x86_64.conf ~/.config/artools/pacman.conf.d/
+sudo -E ./buildiso -p antergos
+```
+
+Use `./buildiso`, not the system `/usr/bin/buildiso` — the system one lacks `--overwrite='*'` and will fail with file conflicts.
+
+## Key gotchas
+
+- **`componentName` in `branding.desc` must match its directory name.** Calamares will bail if they don't match.
+- **Package order in `profile.yaml` matters.** `calamares` must be before `calamares-branding-antergos-next` so branding overwrites defaults.
+- **`[antergos-pkgs]` must be first in `iso-x86_64.conf`.** Custom packages take priority over Artix's.
+- **Copy pacman.conf before building.** `buildiso` uses `~/.config/artools/pacman.conf.d/iso-x86_64.conf`. Without it, it falls back to the system one which lacks the custom repo.
+- **`CMAKE_DISTRIBUTION_NAME` is a no-op.** Calamares ignores it. The "for <distro>" text comes from `versionedName` in the active branding.
+
+## Code style
+
+- Match the surrounding code. No changes are too small to be worth a PR.
+- No unnecessary comments. Code should speak for itself.
+- Keep YAML clean — two-space indentation, no trailing whitespace.
+
+## Getting help
+
+Open a discussion or ping the maintainer. If it's urgent, mention it. If it's not, be patient — I'll get to it.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..785772c
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,30 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest ISO build receives security updates. There are no LTS releases.
+
+| Version | Supported |
+|---------|-----------|
+| latest (rolling) | ✅ |
+
+## Reporting a Vulnerability
+
+Please **do not** report security vulnerabilities through public GitHub issues, discussions, or pull requests.
+
+Instead, report via **GitHub Private Vulnerability Reporting** for this repository. If that's unavailable, email `ash8820@proton.me`.
+
+When reporting, include:
+
+- The ISO build date or commit SHA
+- A description of the issue and why it's security-sensitive
+- Steps to reproduce or a proof of concept
+- Any relevant logs, payloads, or screenshots
+- The potential impact
+- Suggested mitigations or fixes, if known
+
+You can expect an acknowledgment within 3 business days. After assessment, I'll work on a fix and coordinate disclosure timing when appropriate.
+
+## Scope
+
+This covers the ISO build system (`buildiso`, profiles, overlays) and the live environment. For issues in custom packages (calamares, branding, keyring), report to the [antergos-packages](https://github.com/Antergos-NeXT/antergos-packages) repo. For upstream Calamares issues, report to [Calamares upstream](https://codeberg.org/calamares/calamares).