Add dependency/SBOM criteria and releveling by puerco · Pull Request #163 · ossf/security-baseline

puerco · 2025-01-24T19:21:25Z

This commit updates the dependency criteria to add increasing transparency requirements at each level:

Checked in language-native dependency list
Simple SBOM
SBOM with NTIA/CRA data fields

In addition to the two new ones, OSPS-QA-03 is simplified and releveled to 1.

Signed-off-by: Adolfo García Veytia (Puerco) adolfo.garcia@uservers.net

SecurityCRob

i need to adjust the xls to account for this change, but +1

baseline/OSPS-QA.yaml

evankanderson · 2025-01-24T20:00:44Z

baseline/OSPS-QA.yaml

+      language dependency lock file that ennumerates all
+      direct and transitive dependencies such as


Details says "direct and transitive" but criteria says "direct". Which do we require here?

baseline/OSPS-QA.yaml

puerco · 2025-01-24T20:56:56Z

i need to adjust the xls to account for this change,

@SecurityCRob I'm happy to add it to the spreadsheet.
Note that OSPS-QA-11 & OSPS-QA-12 match SSDF PS3, PW4. OSPS-QA-03 is cross referenced to SSDF PO4 and PS1. I think those are not correct, but I didn't want to mess with your original assessment.

eddie-knight

I noticed that the first entry needs to be changed to follow our criterion format

baseline/OSPS-QA.yaml

This commit updates the dependency criteria to add increasing transparency requirements at each level. Signed-off-by: Adolfo García Veytia (Puerco) <adolfo.garcia@uservers.net>

baseline/OSPS-QA.yaml

funnelfiasco

I think we should soften the language in the rationale/details to make it clear that what we're looking for in this criterion is enumeration, not pinning.

On the other hand, if we do want to require some form of pinning at level 1, we need to

Update the criterion text to include that
Specify what sort of pinning is sufficient (e.g. minimum version, branch/release name, specific version, hash, etc etc etc)

For clarity: my strong preference is to go with the first approach and focus on enumeration at level 1.

baseline/OSPS-QA.yaml

SecurityCRob · 2025-01-27T14:30:45Z

i need to adjust the xls to account for this change,

@SecurityCRob I'm happy to add it to the spreadsheet. Note that OSPS-QA-11 & OSPS-QA-12 match SSDF PS3, PW4. OSPS-QA-03 is cross referenced to SSDF PO4 and PS1. I think those are not correct, but I didn't want to mess with your original assessment.

I'll figure this out today, no worries!

Co-authored-by: Ben Cotton <bcotton@funnelfiasco.com> Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

Signed-off-by: Evan Anderson <evan@stacklok.com>

* Enhancement of SA rationales and implementation details <title> Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com> * Update baseline/OSPS-SA.yaml Co-authored-by: Puerco <puerco@users.noreply.github.com> Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com> * Update baseline/OSPS-SA.yaml Co-authored-by: Puerco <puerco@users.noreply.github.com> Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com> * Moved some content into lexicon entries Signed-off-by: Eddie Knight <knight@linux.com> * Update baseline/OSPS-SA.yaml Co-authored-by: Ben Cotton <ben@kusari.dev> Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com> --------- Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com> Signed-off-by: Eddie Knight <knight@linux.com> Co-authored-by: Puerco <puerco@users.noreply.github.com> Co-authored-by: Eddie Knight <knight@linux.com> Co-authored-by: Ben Cotton <ben@kusari.dev>

baseline/OSPS-QA.yaml

Co-authored-by: Eleftheria Stein-Kousathana <eleftheria.kousathana@gmail.com> Signed-off-by: Eddie Knight <knight@linux.com>

suggested update to QA-12 Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

better update than the last one Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

an even better update than the last two Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

* Add a maintenance process Signed-off-by: Ben Cotton <ben@kusari.dev> * Remove "Scorecard/Insights values" from allowed changes Co-authored-by: Eddie Knight <knight@linux.com> Signed-off-by: Ben Cotton <bcotton@funnelfiasco.com> * Update the examples to use our CalVer scheme And also comment them out so that they aren't rendered until there are actual things to put there. Signed-off-by: Ben Cotton <ben@kusari.dev> * Reflect new numbering system Signed-off-by: Ben Cotton <ben@kusari.dev> * Correct wording per ossf#175 Co-authored-by: Eddie Knight <knight@linux.com> Signed-off-by: Ben Cotton <bcotton@funnelfiasco.com> --------- Signed-off-by: Ben Cotton <ben@kusari.dev> Signed-off-by: Ben Cotton <bcotton@funnelfiasco.com> Co-authored-by: Eddie Knight <knight@linux.com>

baseline/OSPS-QA.yaml

Signed-off-by: Ben Cotton <ben@kusari.dev>

Signed-off-by: Eddie Knight <knight@linux.com>

baseline/OSPS-QA.yaml

* Update lexicon.yaml with control mappings add control mapping references Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com> * Update baseline/lexicon.yaml Co-authored-by: Eddie Knight <knight@linux.com> Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com> * Update lexicon.yaml tweaked ssdf Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com> * Update lexicon.yaml now with 100% MOAR SBOM! Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com> * Fix yaml formatting Signed-off-by: Ben Cotton <ben@kusari.dev> * Apply suggestions from code review Co-authored-by: Puerco <puerco@users.noreply.github.com> Signed-off-by: Eddie Knight <knight@linux.com> --------- Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com> Signed-off-by: Ben Cotton <ben@kusari.dev> Signed-off-by: Eddie Knight <knight@linux.com> Co-authored-by: Eddie Knight <knight@linux.com> Co-authored-by: Ben Cotton <ben@kusari.dev> Co-authored-by: Puerco <puerco@users.noreply.github.com>

Signed-off-by: Ben Cotton <ben@kusari.dev>

Co-authored-by: David A. Wheeler <dwheeler@dwheeler.com> Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

Co-authored-by: Eleftheria Stein-Kousathana <eleftheria.kousathana@gmail.com> Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

updated 03 mappings Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

…e into pull/163/head

Signed-off-by: Eddie Knight <knight@linux.com>

updates to qa03 & 11 Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

eddie-knight · 2025-02-14T15:49:44Z

This PR history has gone sideways, and the fix seems more complex than is worthwhile at the moment. I've copied these commits to a new branch and PR.

puerco requested review from SecurityCRob and eddie-knight January 24, 2025 19:21

SecurityCRob approved these changes Jan 24, 2025

View reviewed changes

evankanderson reviewed Jan 24, 2025

View reviewed changes

SecurityCRob added the criteria label Jan 24, 2025

puerco force-pushed the sbom-criteria branch from 9fa7fcc to fbebd45 Compare January 24, 2025 20:49

eddie-knight requested changes Jan 24, 2025

View reviewed changes

baseline/OSPS-QA.yaml Outdated Show resolved Hide resolved

puerco force-pushed the sbom-criteria branch from fbebd45 to d86c896 Compare January 24, 2025 23:16

puerco enabled auto-merge (squash) January 24, 2025 23:59

Add dependency/SBOM critaria and leveling

8478f38

This commit updates the dependency criteria to add increasing transparency requirements at each level. Signed-off-by: Adolfo García Veytia (Puerco) <adolfo.garcia@uservers.net>

puerco force-pushed the sbom-criteria branch from d86c896 to 8478f38 Compare January 25, 2025 00:07

evankanderson approved these changes Jan 25, 2025

View reviewed changes

baseline/OSPS-QA.yaml Outdated Show resolved Hide resolved

evankanderson mentioned this pull request Jan 25, 2025

Fill out half of remaining ruletypes in policy for level 1 mindersec/minder-rules-and-profiles#282

Merged

funnelfiasco requested changes Jan 25, 2025

View reviewed changes

baseline/OSPS-QA.yaml Outdated Show resolved Hide resolved

baseline/OSPS-QA.yaml Outdated Show resolved Hide resolved

baseline/OSPS-QA.yaml Outdated Show resolved Hide resolved

SecurityCRob and others added 2 commits January 27, 2025 09:50

Update baseline/OSPS-QA.yaml

38442a7

Co-authored-by: Ben Cotton <bcotton@funnelfiasco.com> Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

Update baseline/OSPS-QA.yaml

3a1f91b

Co-authored-by: Ben Cotton <bcotton@funnelfiasco.com> Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

funnelfiasco approved these changes Jan 27, 2025

View reviewed changes

mesembria mentioned this pull request Jan 27, 2025

Implement Security Baseline criterion OSPS-QA-03 mindersec/minder-rules-and-profiles#289

Closed

Merge branch 'main' into sbom-criteria

02a504d

evankanderson mentioned this pull request Jan 28, 2025

Check for published SBOM after a release mindersec/minder#3853

Open

evankanderson and others added 2 commits January 28, 2025 12:37

Clarify OSPS-SA-02 (ossf#154)

9ae5930

Signed-off-by: Evan Anderson <evan@stacklok.com>

eleftherias reviewed Jan 31, 2025

View reviewed changes

baseline/OSPS-QA.yaml Outdated Show resolved Hide resolved

eddie-knight and others added 5 commits February 3, 2025 13:27

Update baseline/OSPS-QA.yaml

2ed4504

Co-authored-by: Eleftheria Stein-Kousathana <eleftheria.kousathana@gmail.com> Signed-off-by: Eddie Knight <knight@linux.com>

Update OSPS-QA.yaml

87bebc8

suggested update to QA-12 Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

Update OSPS-QA.yaml

13ba028

better update than the last one Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

Update OSPS-QA.yaml

39584f2

an even better update than the last two Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

david-a-wheeler reviewed Feb 4, 2025

View reviewed changes

baseline/OSPS-QA.yaml Outdated Show resolved Hide resolved

david-a-wheeler reviewed Feb 4, 2025

View reviewed changes

baseline/OSPS-QA.yaml Outdated Show resolved Hide resolved

david-a-wheeler reviewed Feb 4, 2025

View reviewed changes

baseline/OSPS-QA.yaml Outdated Show resolved Hide resolved

funnelfiasco and others added 2 commits February 4, 2025 10:45

Fix build issues (ossf#177)

bd6da25

Signed-off-by: Ben Cotton <ben@kusari.dev>

fix: Trailing comma on QA-02 (ossf#180)

9c797c9

Signed-off-by: Eddie Knight <knight@linux.com>

eleftherias reviewed Feb 5, 2025

View reviewed changes

baseline/OSPS-QA.yaml Outdated Show resolved Hide resolved

SecurityCRob and others added 11 commits February 5, 2025 16:36

Add a back to top button (ossf#183)

919e19f

Signed-off-by: Ben Cotton <ben@kusari.dev>

Add a template for new releases (ossf#178)

b2238d3

Signed-off-by: Ben Cotton <ben@kusari.dev>

Update baseline/OSPS-QA.yaml

b0e9d85

Co-authored-by: David A. Wheeler <dwheeler@dwheeler.com> Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

Update baseline/OSPS-QA.yaml

8d3360c

Co-authored-by: David A. Wheeler <dwheeler@dwheeler.com> Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

Update baseline/OSPS-QA.yaml

5d868ea

Co-authored-by: David A. Wheeler <dwheeler@dwheeler.com> Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

Update baseline/OSPS-QA.yaml

0d4a38d

Co-authored-by: Eleftheria Stein-Kousathana <eleftheria.kousathana@gmail.com> Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

Update OSPS-QA.yaml

5a8cd3f

updated 03 mappings Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

Merge commit 'refs/pull/163/head' of github.com:ossf/security-baselin…

47bfea3

…e into pull/163/head

Updated SBOM criteria and lexicon

e5cfdb9

Signed-off-by: Eddie Knight <knight@linux.com>

Update OSPS-QA.yaml

15aca72

updates to qa03 & 11 Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

eddie-knight mentioned this pull request Feb 14, 2025

Updated and extended dependency + SBOM criteria #186

Merged

eddie-knight closed this Feb 14, 2025

auto-merge was automatically disabled February 14, 2025 15:49
Pull request was closed

		language dependency lock file that ennumerates all
		direct and transitive dependencies such as

Conversation

puerco commented Jan 24, 2025

Uh oh!

SecurityCRob left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

evankanderson Jan 24, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

puerco commented Jan 24, 2025

Uh oh!

eddie-knight left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

funnelfiasco left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

SecurityCRob commented Jan 27, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

eddie-knight commented Feb 14, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants