diff --git a/README.md b/README.md index f22ca8e..378a59f 100644 --- a/README.md +++ b/README.md @@ -7,6 +7,7 @@ reusable GitHub Actions workflows, repository templates, and a conformance check [![Docs: CC BY 4.0](https://img.shields.io/badge/docs-CC%20BY%204.0-lightgrey)](LICENSE-docs) [![Code: MIT](https://img.shields.io/badge/code-MIT-green)](LICENSE) +[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/15366/badge)](https://www.bestpractices.dev/projects/15366) [![Status: draft](https://img.shields.io/badge/status-draft%20(pre--1.0)-orange)](#status) ## Status @@ -34,8 +35,9 @@ v1.0* once the checker passes on it. [conformance checker](#check-a-repositorys-conformance). Security assurance is recorded in the [Best Practices assessment](docs/security/best-practices.md) -and [parser fuzzing guide](docs/security/fuzzing.md). Badge enrollment is temporarily -blocked under [EX-0007](exceptions/register.md#ex-0007); no passing badge is claimed. +and [parser fuzzing guide](docs/security/fuzzing.md). The repository earned the +[OpenSSF Best Practices passing badge](https://www.bestpractices.dev/projects/15366) +on 2026-10-10 through a maintainer self-assessment. ## Contents diff --git a/docs/security/assurance.json b/docs/security/assurance.json index 04a2925..b219e4b 100644 --- a/docs/security/assurance.json +++ b/docs/security/assurance.json @@ -3,7 +3,7 @@ "badge": { "applicability": "required", "reason": "Public open-source Product repository distributing standards and executable tooling.", - "projectUrl": null, + "projectUrl": "https://www.bestpractices.dev/projects/15366", "evidence": "docs/security/best-practices.md" }, "fuzzing": { diff --git a/docs/security/best-practices.md b/docs/security/best-practices.md index 153c641..cac5e0a 100644 --- a/docs/security/best-practices.md +++ b/docs/security/best-practices.md @@ -3,28 +3,31 @@ ## Enrollment and review **Repository:** . **Owner:** @KofTwentyTwo. -**Prepared:** 2026-10-10. **Enrollment review:** 2026-10-17; **exception expiry:** -2026-11-10 ([EX-0007](../../exceptions/register.md#ex-0007)). Once enrolled, reassess -within 90 days and before each MINOR or MAJOR release. +**Assessment:** [project 15366](https://www.bestpractices.dev/en/projects/15366/passing). +**Level:** Passing. **Reviewed and earned:** 2026-10-10. +**Next review:** 2027-01-08, or before the next MINOR or MAJOR release, whichever +occurs first. Reassess at least every 90 days. -The maintainer reported an anti-spam login restriction and deferred enrollment. -There is no registered project ID, submitted assessment, progress percentage, or -passing badge. The table below is prepared evidence for the current -[passing criteria](https://www.bestpractices.dev/en/criteria/0), not certification. -Use those criterion IDs in the provider's form; answers still require owner review. +The public assessment identifies this repository and displays the passing badge. +The maintainer completed the self-assessment, including personal attestations. +This badge records voluntary maintainer self-certification. +The enrollment-only exception [EX-0007](../../exceptions/register.md#ex-0007) is +closed with the actual README badge and project URL recorded in +[assurance.json](assurance.json). ## Criterion evidence matrix IDs below omit the provider's `0.` level prefix. **Evidence** means source exists; -**Review** means operational evidence or human judgment is still needed; -**Proposed N/A** needs the provider's applicability rules and owner approval. +**Review** marks ongoing operational evidence or human judgment to revalidate; +**Proposed N/A** preserves applicability reasoning for the next review. These are +local evidence notes; the linked public assessment holds the submitted answers. -| Criteria | Prepared evidence / remaining decision | State | +| Criteria | Evidence and ongoing review | State | | --- | --- | --- | | `description_good`, `documentation_basics` | [README](../../README.md) describes standards, tooling and adoption | Evidence | | `interact`, `discussion`, `report_process`, `report_tracker`, `report_archive` | Public [issues](https://github.com/KofTwentyTwo/standards/issues), templates and [CONTRIBUTING](../../CONTRIBUTING.md) | Evidence | | `contribution`, `contribution_requirements` | CONTRIBUTING documents proposals, signed commits, DCO, review and gates | Evidence | -| `floss_license`, `floss_license_osi`, `license_location` | Root [MIT](../../LICENSE) for code, configs and templates; [CC BY 4.0](../../LICENSE-docs) for prose. Explain the separate documentation license | Evidence | +| `floss_license`, `floss_license_osi`, `license_location` | Root [MIT](../../LICENSE) for code, configs and templates; [CC BY 4.0](../../LICENSE-docs) for prose; attributed Apache-2.0 material in [NOTICE](../../NOTICE) | Evidence | | `documentation_interface` | [Tool help and local commands](../../CONTRIBUTING.md#running-the-checks-locally), [release instructions](../releases.md); owner checks shipped tools' help completeness | Review | | `sites_https`, `delivery_mitm` | GitHub repository and release delivery use HTTPS; [verification](../../standards/releases.md#verifying-a-release) checks provenance | Evidence | | `english` | Repository documentation and contribution guidance are in English | Evidence | @@ -33,13 +36,14 @@ IDs below omit the provider's `0.` level prefix. **Evidence** means source exist | `version_unique`, `version_semver`, `version_tags`, `release_notes` | Immutable [v0.1.2](https://github.com/KofTwentyTwo/standards/releases/tag/v0.1.2), committed version and [changelog](../../CHANGELOG.md); failed unpublished tags are reserved | Evidence | | `release_notes_vulns` | [Release standard](../../standards/releases.md) requires security fix notes; no published vulnerability fix history to attest to yet | Review | | `vulnerability_report_process`, `vulnerability_report_private` | [SECURITY](../../SECURITY.md) links private GitHub reporting and supported versions | Evidence | -| `vulnerability_report_response` | SECURITY defines targets; maintainer confirms monitored contact and actual response capability | Review | +| `vulnerability_report_response` | Maintainer confirmed actual response compliance on 2026-10-10 in the public assessment; revalidate report history, not just SECURITY targets | Review | | `build`, `build_common_tools`, `build_floss_tools` | [Bundle builder](../../tools/Build-StandardsPackage.ps1) uses Git archives and PowerShell; prerequisites and release steps are documented | Evidence | | `test`, `test_invocation`, `test_policy`, `tests_are_added`, `tests_documented_added` | CONTRIBUTING requires behavioral regression tests and documents checker, package and fuzz commands | Evidence | | `test_continuous_integration` | [CI](../../.github/workflows/ci.yml) runs tests on PR/main, schedules and tag publication gates | Evidence | -| `test_most` | Parser properties, helper self-tests and package tests exist; no measured whole-tool coverage. Owner must assess most functionality, not infer it from case counts | Review | -| `warnings`, `warnings_fixed`, `warnings_strict` | Markdown/workflow gates reject findings. Broad PowerShell warning coverage is not established by Actions CodeQL; assess this gap separately | Review | -| `know_secure_design`, `know_common_errors` | [Threat model](threat-model.md), [security policy](../../policies/security-program.md) and parser regressions support discussion; a primary human developer must personally attest to the required knowledge | Review | +| `test_most` | Parser properties, helper self-tests and package tests exist; measured whole-tool coverage is not established | Suggested: Unmet | +| `warnings`, `warnings_fixed` | Markdown/workflow gates reject findings; revalidate applicable PowerShell warning handling | Review | +| `warnings_strict` | Maximal PowerShell warning/linter coverage across shipped tooling is not established by Actions CodeQL | Suggested: Unmet | +| `know_secure_design`, `know_common_errors` | Primary maintainer personally attested on 2026-10-10; supporting [threat model](threat-model.md), [security policy](../../policies/security-program.md) and parser regressions remain review evidence | Review | | `crypto_published`, `crypto_call`, `crypto_floss`, `crypto_keylength`, `crypto_working`, `crypto_weaknesses` | No custom product cryptography. GitHub TLS, SSH signing and attestations are delegated mechanisms; assess whether delegation meets each criterion or permits N/A | Review | | `crypto_pfs` | No application server or product-controlled TLS configuration; document the hosted-service boundary if N/A is permitted | Proposed N/A | | `crypto_password_storage` | No application passwords, password database or credential-storage implementation | Proposed N/A | @@ -53,16 +57,17 @@ IDs below omit the provider's `0.` level prefix. **Evidence** means source exist | `dynamic_analysis_unsafe` | Shipped tooling is managed PowerShell, not unsafe native-language implementation; owner validates applicability | Proposed N/A | | `dynamic_analysis_fixed` | Generated-input findings gained deterministic regressions; review all future campaign failures before assessment updates | Review | -## Completing enrollment +## Maintaining the assessment -1. Retry normal GitHub login at after the provider - restriction clears; register the exact repository above. Do not bypass anti-spam. -2. Review every proposed answer against the live criteria and actual evidence, - including human knowledge, unresolved findings, and observed response history. -3. Put the actual project URL in [assurance.json](assurance.json) and add the - provider's linked badge to README. Record the resulting assessment level honestly. -4. Close EX-0007 through a normal PR and set the next assessment review date. - Work toward passing by resolving genuine gaps; registration is not passing. +1. Review the public answers against current criteria and repository evidence by the + next review date and before each MINOR or MAJOR release. +2. Reconfirm human knowledge, unresolved findings and actual response history with + the maintainer; update answers when evidence or applicability changes. +3. Keep the provider's live badge, project URL and this review record synchronized. + Downstream repositories need their own assessment and badge. +4. Improve the unmet suggested criteria `test_most` and `warnings_strict`; passing + does not establish whole-tool coverage or maximal warning coverage. Track the + shared release smoke-test gap in [issue #22](https://github.com/KofTwentyTwo/standards/issues/22). Downstream repositories use the [assessment template](../../templates/repo/docs/security/best-practices.md) and their own evidence and project ID; EX-0007 does not apply to them. diff --git a/docs/security/scorecard-dispositions.md b/docs/security/scorecard-dispositions.md index b6a8655..72f16e3 100644 --- a/docs/security/scorecard-dispositions.md +++ b/docs/security/scorecard-dispositions.md @@ -14,10 +14,12 @@ changes or predict future maintenance. Keep the accepted risk visible; dismissal is not a claim that the missing second maintainer exists. Do not disable Scorecard or weaken protections. Reopen and -reassess these dispositions when their assumptions change. The LOW best-practices -badge and MEDIUM fuzzing recommendations remain visible. The -[badge assessment](best-practices.md) records deferred enrollment under EX-0007; -[native parser fuzzing](fuzzing.md) now supplies generated security properties and +reassess these dispositions when their assumptions change. The +[badge assessment](best-practices.md) records the passing badge for +[project 15366](https://www.bestpractices.dev/projects/15366), earned on 2026-10-10; +EX-0007 is closed. Let the next Scorecard scan reassess the badge finding rather +than claiming a new score before it runs. The MEDIUM fuzzing recommendation remains +visible: [native parser fuzzing](fuzzing.md) supplies generated security properties and regressions. Scorecard may not recognize this PowerShell harness; do not label a score of zero as proof that tests did not run or claim a supported integration. diff --git a/exceptions/register.md b/exceptions/register.md index a13545c..792f9f2 100644 --- a/exceptions/register.md +++ b/exceptions/register.md @@ -11,7 +11,7 @@ Open and closed exceptions to the KofTwentyTwo standards. The process is in | [EX-0004](#ex-0004) | Open | K22-CI-30, K22-REL-04 (shared release workflow) | gclo | When the shared reusable release workflow ships, at the latest 2027-04-09 | | [EX-0005](#ex-0005) | Open | K22-AI-10 (agents via PR only), K22-AI-11 (in part: unconfirmed pushes) | second-brain, nix, Praetor, Jellyfin | Reviewed yearly, next on 2027-10-10 | | [EX-0006](#ex-0006) | Open | K22-CI-16 (tag-only environment secrets) | standards | 2027-04-10; review 2027-01-10 | -| [EX-0007](#ex-0007) | Open | K22-REPO-12 (enrollment) | KofTwentyTwo/standards | 2026-11-10; review 2026-10-17 | +| [EX-0007](#ex-0007) | Closed | K22-REPO-12 (enrollment) | KofTwentyTwo/standards | Closed 2026-10-10 | ## EX-0001 @@ -178,9 +178,11 @@ Open and closed exceptions to the KofTwentyTwo standards. The process is in - **Requirements:** `K22-REPO-12` enrollment and the actual README badge only. - **Scope:** `KofTwentyTwo/standards`; no downstream repository is covered. - **Reason:** on 2026-10-10 the maintainer could not sign in because of the provider's - anti-spam restriction and explicitly deferred enrollment. No project ID exists. -- **Risk:** consumers cannot inspect a registered provider assessment yet. -- **Compensating controls:** publish the [criterion evidence](../docs/security/best-practices.md) + anti-spam restriction and explicitly deferred enrollment. No project ID existed + when this exception was approved. +- **Risk:** consumers could not inspect a registered provider assessment during the + enrollment deferral. +- **Compensating controls (while open):** publish the [criterion evidence](../docs/security/best-practices.md) and pending answers; retain existing security/PR gates and parser fuzzing. Do not claim participation or a passing badge. Retry normal login once the restriction clears, register the exact repository URL, and close this exception through a PR. @@ -188,3 +190,8 @@ Open and closed exceptions to the KofTwentyTwo standards. The process is in whichever occurs first. **Review:** 2026-10-17. - **Owner:** @KofTwentyTwo. Approval is recorded by the normal exception-register PR; this entry does not authorize bypassing CI or publishing an unreviewed assessment. +- **Closed:** 2026-10-10. [Project 15366](https://www.bestpractices.dev/projects/15366) + identifies this repository and has earned the passing badge. The actual linked + badge is in [README](../README.md), the project URL is in + [assurance.json](../docs/security/assurance.json), and the + [assessment record](../docs/security/best-practices.md) sets the next review date.