Enhance security guidelines for software supply chain

Aperta
  • Qualcosa non va?
#486 0 commenti 0 reazioni 7 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@trumant ci sta già lavorando.

Dal 17/3/2026.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

#387 by @JustinCappos has raised good discussion around the difference between assessing the elements a project has authored, and the elements they have imported as dependencies. There is some nuance to how these objectives might be phrased, as noted by David below.

The goals are sensible, but this needs more specifics. What exactly are we expecting people to do? How will they know when they're done? What are the specific examples of the risks you intend to tackle? E.g.: typosquatting, dependency confusion, malicious GitHub Actions, malicious packages, etc.

We discussed this today, and the plan is to open a new issue to discuss this in more detail and work out more specific to address this.

Originally posted by @david-a-wheeler in https://github.com/ossf/security-baseline/issues/387#issuecomment-4075392746

Related existing controls:

DO-06 Publish Dependency Management Policy
BR-05 Use Standardized Dependency Management Tools
QA-02 Publish Software Dependencies
BR-01 Prevent Untrusted Input When Building & Releasing
AC-04 Enforce Least Privilege on CI/CD Pipelines
VM-05 Publish and Enforce a Dependency Remediation Policy
QA-05 Prevent Executables in the Codebase
QA-06 Use Automated Testing in CI/CD Pipelines

Originally posted by @evankanderson in https://github.com/ossf/security-baseline/issues/387#issuecomment-4075520623

TODO

  • Establish a consensus in this issue regarding the current and proposed control objectives
  • Propose new control objectives in a new PR, with draft assessment requirements
  • Refine the specific test requirements to ensure they meet the intent of their respective objectives
  • Gather community feedback on the PR
Lingua principale
Go
Stelle
171
Fork
45
Merge medio
1g 16h
PR unite (30g)
7

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di ossf/security-baseline

Tutte le issue di ossf/security-baseline

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.