Define mandatory badge participation and applicable parser fuzzing #18

New Issue

2026-10-10T17:01:50Z

KofTwentyTwo commented

2026-10-10 17:01:50 +00:00

(Migrated from github.com)

Public Product repositories should participate in the OpenSSF Best Practices program, and repositories with complex untrusted-input parsers should run meaningful, reproducible fuzz targets in CI. The maintainer selected mandatory requirements where applicable.

Proposed implementation:

Add K22-REPO-12 for enrollment and maintained, evidence-backed assessment, with a passing badge as the target rather than a fabricated achievement.
Add K22-TEST-25 for applicable parser fuzzing, retaining K22-TEST-23's negative-test guidance. Require documented scope, bounded PR/main campaigns, longer scheduled/release campaigns, and retained regression cases.
Supply adoption templates, conformance checks, and this repository's PowerShell property-based fuzz harness.
Prepare the badge criterion evidence. Enrollment is deferred by the maintainer because the provider's anti-spam restriction prevents login; propose a standards-only exception expiring 2026-11-10, reviewed 2026-10-17.
Record Scorecard detection limits honestly: native PowerShell fuzzing may not be recognized. Do not add unrelated integrations merely to increase the score.

New MUSTs are a breaking standards change and require a MAJOR release when published. This work does not change the already published immutable v0.1.2 bundle or reserve/publish another release.

Substantial AI assistance: OpenAI GPT-6 Codex, under maintainer authorization.

Public Product repositories should participate in the OpenSSF Best Practices program, and repositories with complex untrusted-input parsers should run meaningful, reproducible fuzz targets in CI. The maintainer selected mandatory requirements where applicable. Proposed implementation: - Add K22-REPO-12 for enrollment and maintained, evidence-backed assessment, with a passing badge as the target rather than a fabricated achievement. - Add K22-TEST-25 for applicable parser fuzzing, retaining K22-TEST-23's negative-test guidance. Require documented scope, bounded PR/main campaigns, longer scheduled/release campaigns, and retained regression cases. - Supply adoption templates, conformance checks, and this repository's PowerShell property-based fuzz harness. - Prepare the badge criterion evidence. Enrollment is deferred by the maintainer because the provider's anti-spam restriction prevents login; propose a standards-only exception expiring 2026-11-10, reviewed 2026-10-17. - Record Scorecard detection limits honestly: native PowerShell fuzzing may not be recognized. Do not add unrelated integrations merely to increase the score. New MUSTs are a breaking standards change and require a MAJOR release when published. This work does not change the already published immutable v0.1.2 bundle or reserve/publish another release. Substantial AI assistance: OpenAI GPT-6 Codex, under maintainer authorization.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/standards#18