Skip to content

Add links to Minder rule types.#157

Closed
teodor-yanev wants to merge 7 commits intoossf:mainfrom
teodor-yanev:add-minder-rules-links-baseline-1
Closed

Add links to Minder rule types.#157
teodor-yanev wants to merge 7 commits intoossf:mainfrom
teodor-yanev:add-minder-rules-links-baseline-1

Conversation

@teodor-yanev
Copy link

@teodor-yanev teodor-yanev commented Jan 20, 2025

This change adds links to existing Minder rule types that implement Baseline checks.

Note: OSPS-DO-01 and OSPS-DO-02 are no longer included under any of the levels of the security baselines.
Update: Seems like the two rules above have changed their governance criteria as part of https://github.com/ossf/security-baseline/pull/130/files
I will be addressing this separately and adding them in the next batch of rules that we link to Minder -- this will include moving and renaming the files and then updating the yamls again

@teodor-yanev teodor-yanev force-pushed the add-minder-rules-links-baseline-1 branch 3 times, most recently from df97f67 to 304aa46 Compare January 20, 2025 13:59
@teodor-yanev teodor-yanev changed the title add: minder-rules-links-baseline-1 Add links to Minder rule types. Jan 20, 2025
@teodor-yanev teodor-yanev reopened this Jan 20, 2025
SecurityCRob and others added 5 commits January 20, 2025 18:41
* Adding Regulatory crosswalk mappings to QA category items

Adding Regulatory crosswalk mappings to QA category items

Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

* Update baseline/OSPS-QA.yaml

Signed-off-by: Eddie Knight <knight@linux.com>

---------

Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>
Signed-off-by: Eddie Knight <knight@linux.com>
Co-authored-by: Eddie Knight <knight@linux.com>
Signed-off-by: Teodor Yanev <teodor@stacklok.com>
Try to make it better match the original intent.

Fixes ossf#63

Signed-off-by: Ben Cotton <ben@kusari.dev>
Signed-off-by: Eddie Knight <knight@linux.com>
Co-authored-by: Eddie Knight <knight@linux.com>
Signed-off-by: Teodor Yanev <teodor@stacklok.com>
baseline 1; first batch

Signed-off-by: Teodor Yanev <teodor@stacklok.com>
Signed-off-by: Teodor Yanev <teodor@stacklok.com>
Signed-off-by: Teodor Yanev <teodor@stacklok.com>
@teodor-yanev teodor-yanev force-pushed the add-minder-rules-links-baseline-1 branch from c35a52c to 757f946 Compare January 20, 2025 16:41
@eddie-knight
Copy link
Contributor

I believe when we removed the scorecard values we decided against hard-coupling to other projects, is that right @SecurityCRob?

Now that I think about it, I'm not sure whether that's applicable to security insights as well.

Copy link
Contributor

@SecurityCRob SecurityCRob left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we discussed this briefing in the call today. In general, I support and want to capture this type of information and share with consumers of Baseline. I think the final form will morph perhaps, but I'm find accepting this so that we get the links/data and we can shuffle the content to its final home as we decide how we want to represent things like Scorecard, Minder, etc.

@evankanderson
Copy link
Contributor

As mentioned in the call, we should see about versioning these Minder rules in alignment with the baseline calver versions.

@eddie-knight
Copy link
Contributor

Hey team, I'm going to close this PR as part of the decision logged in #189.

This corresponds to #190, which will remove all references to Security Insights.

For the sake of posterity — As a maintainer of Security Insights, I was originally quite optimistic about adding references to implementations, and I'm empathetic to the work that was done in this PR ✊

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants