docs(security): enroll Windows app in OpenSSF Best Practices #31

New Issue

2026-10-12T04:01:05Z

KofTwentyTwo commented

2026-10-12 04:01:05 +00:00

(Migrated from github.com)

MarkdownViewr.Windows is a public open-source Product. K22-REPO-12 now requires a real OpenSSF Best Practices project entry, actual matching README badge and evidence-backed assessment in docs/security/best-practices.md, with a90-day/pre-MAJOR/MINOR review and assurance.json scope record.

No project ID or enrollment is established for this app. Prepare the criterion evidence and remaining actions. The maintainer must enroll the exact Windows repository and attest the answers; use the returned real URL/ID. Do not add a placeholder badge, infer a passing badge from enrollment or mark the public Product inapplicable. Any enrollment obstacle requires a reviewed dated exception, not an agent-approved bypass.

Keep owner review, actual signing, threat model and CI evidence accurate. Related: #1 and the parser-fuzzing work. Substantial AI assistance: Codex.

MarkdownViewr.Windows is a public open-source Product. K22-REPO-12 now requires a real OpenSSF Best Practices project entry, actual matching README badge and evidence-backed assessment in `docs/security/best-practices.md`, with a90-day/pre-MAJOR/MINOR review and `assurance.json` scope record. No project ID or enrollment is established for this app. Prepare the criterion evidence and remaining actions. The maintainer must enroll the exact Windows repository and attest the answers; use the returned real URL/ID. Do not add a placeholder badge, infer a passing badge from enrollment or mark the public Product inapplicable. Any enrollment obstacle requires a reviewed dated exception, not an agent-approved bypass. Keep owner review, actual signing, threat model and CI evidence accurate. Related: #1 and the parser-fuzzing work. Substantial AI assistance: Codex.

KofTwentyTwo commented

2026-10-12 05:16:49 +00:00

(Migrated from github.com)

Prepared docs/security/best-practices.md and assurance.json with actual public Product scope, evidence and maintainer actions. Project URL is null because real enrollment has not been established. README has no fabricated badge; fresh standards checker correctly keeps K22-REPO-12 failing for enrollment. No enrollment exception or criterion answer is approved by an agent.

The maintainer must enroll/verify the exact Windows repository at bestpractices.dev, supply its actual project URL/ID, review answers against operations, and add the matching real badge. Parser campaigns and CI evidence are recorded separately; unsigned fixtures do not establish signing or a passing provider assessment. Substantial AI assistance: Codex.

Prepared `docs/security/best-practices.md` and `assurance.json` with actual public Product scope, evidence and maintainer actions. Project URL is null because real enrollment has not been established. README has no fabricated badge; fresh standards checker correctly keeps K22-REPO-12 failing for enrollment. No enrollment exception or criterion answer is approved by an agent. The maintainer must enroll/verify the exact Windows repository at bestpractices.dev, supply its actual project URL/ID, review answers against operations, and add the matching real badge. Parser campaigns and CI evidence are recorded separately; unsigned fixtures do not establish signing or a passing provider assessment. Substantial AI assistance: Codex.

KofTwentyTwo commented

2026-10-12 17:41:29 +00:00

(Migrated from github.com)

Registered the Windows repository as OpenSSF project15417 on 2026-10-12: https://www.bestpractices.dev/en/projects/15417. The actual progress badge and evidence are recorded in baee14f. Provider import started at18%; maintainer operating-practice assessment remains incomplete. Registration is complete, passing status is not claimed.

Registered the Windows repository as OpenSSF project15417 on 2026-10-12: https://www.bestpractices.dev/en/projects/15417. The actual progress badge and evidence are recorded in baee14f. Provider import started at18%; maintainer operating-practice assessment remains incomplete. Registration is complete, passing status is not claimed.

KofTwentyTwo commented

2026-10-12 18:23:57 +00:00

(Migrated from github.com)

Owner-reviewed answers and confirmed security knowledge/no private report history have now been saved to https://www.bestpractices.dev/en/projects/15417/passing under owner-confirmed CDLA-Permissive2.0. Actual provider progress is70%; no passing badge is claimed. Remaining cryptography/release/reporting criteria stay open for evidence-backed completion.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/MarkdownViewr.Windows#31