added two new criteria #35
Conversation
added new criteria "Releases are Signed" as OSPS-53 Signed-off-by: CRob <[email protected]>
added new criteria for SAST scanning OSPS-54 Signed-off-by: CRob <[email protected]>
Update baseline.yaml
Signed-off-by: CRob <[email protected]>
Update baseline.yaml
SecurityCRob
added
documentation
| @@ -720,6 +720,55 @@ criteria: | |||
| in a separate repository and fetched during | |||
| a specific well-documented pipeline step. | |||
| control_mappings: # TODO | |||
| security_insights_value: # TODO | |||
| scorecard_probe: # TODO | |||
| - id: OSPS-53 | |||
There was a problem hiding this comment.
I disagree with this one as worded fairly strongly.
I would reword it "cryptographically attested" -- We've seen multiple issues with just signing a piece of software.
There was a problem hiding this comment.
@mlieberman85 If the desire is for more than signing— should we split this into Lv2 signature, and Lv3 for more complete attestation?
There was a problem hiding this comment.
I think that's reasonable. I think we should also be clear what just blanket "signing" should be interpreted as. Since people sign a lot of stuff for a lot of reasons, which is why folks have been moving to attestations so it's clear what the intent of the signing is.
There was a problem hiding this comment.
I think the first level should be plain signing with published singer identities. It's way easier to implement plain signing and it gets us initial integrity guarantees.
Co-authored-by: Tom Hennen <[email protected]> Signed-off-by: CRob <[email protected]>
Co-authored-by: Tom Hennen <[email protected]> Signed-off-by: CRob <[email protected]>
Co-authored-by: Eddie Knight <[email protected]> Signed-off-by: CRob <[email protected]>
Co-authored-by: Puerco <[email protected]> Signed-off-by: CRob <[email protected]>
| security_insights_value: # TODO | ||
| scorecard_probe: | ||
| - releasesAreSigned | ||
| - id: OSPS-54 |
There was a problem hiding this comment.
I'd suggest splitting this out into a separate PR, since it seems less controversial than the other one.
add osps-53 & osps-54 per convo with eknight