diff --git a/.cspell.yaml b/.cspell.yaml index 04b6300e..1d1cf5d6 100644 --- a/.cspell.yaml +++ b/.cspell.yaml @@ -13,6 +13,7 @@ ignorePaths: - '*.{csv,go,mod,scss,sum}' - 'CNAME' - 'LICENSE' + - 'docs/assets/' - 'docs/versions/' - '.github/workflows' - '.golangci.yaml' diff --git a/.gitignore b/.gitignore index bcd2795f..4ae20cae 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,6 @@ docs/versions/devel.md .DS_Store +docs/_site # generated output from go run ./... compile checklist.md diff --git a/.project-words.txt b/.project-words.txt index 25369516..923558a3 100644 --- a/.project-words.txt +++ b/.project-words.txt @@ -10,6 +10,7 @@ FINOS Fintech Gesmer golangci +hyperpage incentivizing lifecycles NCSC @@ -38,3 +39,4 @@ triaging unreviewable UKSSCOP Updegrove +webfonts diff --git a/docs/Gemfile b/docs/Gemfile new file mode 100644 index 00000000..edd66223 --- /dev/null +++ b/docs/Gemfile @@ -0,0 +1,7 @@ +# frozen_string_literal: true + +source "https://rubygems.org" + +gem "github-pages", "~> 232", group: :jekyll_plugins + +gem "webrick", "~> 1.9" diff --git a/docs/Gemfile.lock b/docs/Gemfile.lock new file mode 100644 index 00000000..ca5ad561 --- /dev/null +++ b/docs/Gemfile.lock @@ -0,0 +1,310 @@ +GEM + remote: https://rubygems.org/ + specs: + activesupport (8.0.2) + base64 + benchmark (>= 0.3) + bigdecimal + concurrent-ruby (~> 1.0, >= 1.3.1) + connection_pool (>= 2.2.5) + drb + i18n (>= 1.6, < 2) + logger (>= 1.4.2) + minitest (>= 5.1) + securerandom (>= 0.3) + tzinfo (~> 2.0, >= 2.0.5) + uri (>= 0.13.1) + addressable (2.8.7) + public_suffix (>= 2.0.2, < 7.0) + base64 (0.2.0) + benchmark (0.4.1) + bigdecimal (3.2.2) + coffee-script (2.4.1) + coffee-script-source + execjs + coffee-script-source (1.12.2) + colorator (1.1.0) + commonmarker (0.23.11) + concurrent-ruby (1.3.5) + connection_pool (2.5.3) + csv (3.3.5) + dnsruby (1.72.4) + base64 (~> 0.2.0) + logger (~> 1.6.5) + simpleidn (~> 0.2.1) + drb (2.2.3) + em-websocket (0.5.3) + eventmachine (>= 0.12.9) + http_parser.rb (~> 0) + ethon (0.16.0) + ffi (>= 1.15.0) + eventmachine (1.2.7) + execjs (2.10.0) + faraday (2.13.4) + faraday-net_http (>= 2.0, < 3.5) + json + logger + faraday-net_http (3.4.1) + net-http (>= 0.5.0) + ffi (1.17.2-aarch64-linux-gnu) + ffi (1.17.2-aarch64-linux-musl) + ffi (1.17.2-arm-linux-gnu) + ffi (1.17.2-arm-linux-musl) + ffi (1.17.2-arm64-darwin) + ffi (1.17.2-x86_64-darwin) + ffi (1.17.2-x86_64-linux-gnu) + ffi (1.17.2-x86_64-linux-musl) + forwardable-extended (2.6.0) + gemoji (4.1.0) + github-pages (232) + github-pages-health-check (= 1.18.2) + jekyll (= 3.10.0) + jekyll-avatar (= 0.8.0) + jekyll-coffeescript (= 1.2.2) + jekyll-commonmark-ghpages (= 0.5.1) + jekyll-default-layout (= 0.1.5) + jekyll-feed (= 0.17.0) + jekyll-gist (= 1.5.0) + jekyll-github-metadata (= 2.16.1) + jekyll-include-cache (= 0.2.1) + jekyll-mentions (= 1.6.0) + jekyll-optional-front-matter (= 0.3.2) + jekyll-paginate (= 1.1.0) + jekyll-readme-index (= 0.3.0) + jekyll-redirect-from (= 0.16.0) + jekyll-relative-links (= 0.6.1) + jekyll-remote-theme (= 0.4.3) + jekyll-sass-converter (= 1.5.2) + jekyll-seo-tag (= 2.8.0) + jekyll-sitemap (= 1.4.0) + jekyll-swiss (= 1.0.0) + jekyll-theme-architect (= 0.2.0) + jekyll-theme-cayman (= 0.2.0) + jekyll-theme-dinky (= 0.2.0) + jekyll-theme-hacker (= 0.2.0) + jekyll-theme-leap-day (= 0.2.0) + jekyll-theme-merlot (= 0.2.0) + jekyll-theme-midnight (= 0.2.0) + jekyll-theme-minimal (= 0.2.0) + jekyll-theme-modernist (= 0.2.0) + jekyll-theme-primer (= 0.6.0) + jekyll-theme-slate (= 0.2.0) + jekyll-theme-tactile (= 0.2.0) + jekyll-theme-time-machine (= 0.2.0) + jekyll-titles-from-headings (= 0.5.3) + jemoji (= 0.13.0) + kramdown (= 2.4.0) + kramdown-parser-gfm (= 1.1.0) + liquid (= 4.0.4) + mercenary (~> 0.3) + minima (= 2.5.1) + nokogiri (>= 1.16.2, < 2.0) + rouge (= 3.30.0) + terminal-table (~> 1.4) + webrick (~> 1.8) + github-pages-health-check (1.18.2) + addressable (~> 2.3) + dnsruby (~> 1.60) + octokit (>= 4, < 8) + public_suffix (>= 3.0, < 6.0) + typhoeus (~> 1.3) + html-pipeline (2.14.3) + activesupport (>= 2) + nokogiri (>= 1.4) + http_parser.rb (0.8.0) + i18n (1.14.7) + concurrent-ruby (~> 1.0) + jekyll (3.10.0) + addressable (~> 2.4) + colorator (~> 1.0) + csv (~> 3.0) + em-websocket (~> 0.5) + i18n (>= 0.7, < 2) + jekyll-sass-converter (~> 1.0) + jekyll-watch (~> 2.0) + kramdown (>= 1.17, < 3) + liquid (~> 4.0) + mercenary (~> 0.3.3) + pathutil (~> 0.9) + rouge (>= 1.7, < 4) + safe_yaml (~> 1.0) + webrick (>= 1.0) + jekyll-avatar (0.8.0) + jekyll (>= 3.0, < 5.0) + jekyll-coffeescript (1.2.2) + coffee-script (~> 2.2) + coffee-script-source (~> 1.12) + jekyll-commonmark (1.4.0) + commonmarker (~> 0.22) + jekyll-commonmark-ghpages (0.5.1) + commonmarker (>= 0.23.7, < 1.1.0) + jekyll (>= 3.9, < 4.0) + jekyll-commonmark (~> 1.4.0) + rouge (>= 2.0, < 5.0) + jekyll-default-layout (0.1.5) + jekyll (>= 3.0, < 5.0) + jekyll-feed (0.17.0) + jekyll (>= 3.7, < 5.0) + jekyll-gist (1.5.0) + octokit (~> 4.2) + jekyll-github-metadata (2.16.1) + jekyll (>= 3.4, < 5.0) + octokit (>= 4, < 7, != 4.4.0) + jekyll-include-cache (0.2.1) + jekyll (>= 3.7, < 5.0) + jekyll-mentions (1.6.0) + html-pipeline (~> 2.3) + jekyll (>= 3.7, < 5.0) + jekyll-optional-front-matter (0.3.2) + jekyll (>= 3.0, < 5.0) + jekyll-paginate (1.1.0) + jekyll-readme-index (0.3.0) + jekyll (>= 3.0, < 5.0) + jekyll-redirect-from (0.16.0) + jekyll (>= 3.3, < 5.0) + jekyll-relative-links (0.6.1) + jekyll (>= 3.3, < 5.0) + jekyll-remote-theme (0.4.3) + addressable (~> 2.0) + jekyll (>= 3.5, < 5.0) + jekyll-sass-converter (>= 1.0, <= 3.0.0, != 2.0.0) + rubyzip (>= 1.3.0, < 3.0) + jekyll-sass-converter (1.5.2) + sass (~> 3.4) + jekyll-seo-tag (2.8.0) + jekyll (>= 3.8, < 5.0) + jekyll-sitemap (1.4.0) + jekyll (>= 3.7, < 5.0) + jekyll-swiss (1.0.0) + jekyll-theme-architect (0.2.0) + jekyll (> 3.5, < 5.0) + jekyll-seo-tag (~> 2.0) + jekyll-theme-cayman (0.2.0) + jekyll (> 3.5, < 5.0) + jekyll-seo-tag (~> 2.0) + jekyll-theme-dinky (0.2.0) + jekyll (> 3.5, < 5.0) + jekyll-seo-tag (~> 2.0) + jekyll-theme-hacker (0.2.0) + jekyll (> 3.5, < 5.0) + jekyll-seo-tag (~> 2.0) + jekyll-theme-leap-day (0.2.0) + jekyll (> 3.5, < 5.0) + jekyll-seo-tag (~> 2.0) + jekyll-theme-merlot (0.2.0) + jekyll (> 3.5, < 5.0) + jekyll-seo-tag (~> 2.0) + jekyll-theme-midnight (0.2.0) + jekyll (> 3.5, < 5.0) + jekyll-seo-tag (~> 2.0) + jekyll-theme-minimal (0.2.0) + jekyll (> 3.5, < 5.0) + jekyll-seo-tag (~> 2.0) + jekyll-theme-modernist (0.2.0) + jekyll (> 3.5, < 5.0) + jekyll-seo-tag (~> 2.0) + jekyll-theme-primer (0.6.0) + jekyll (> 3.5, < 5.0) + jekyll-github-metadata (~> 2.9) + jekyll-seo-tag (~> 2.0) + jekyll-theme-slate (0.2.0) + jekyll (> 3.5, < 5.0) + jekyll-seo-tag (~> 2.0) + jekyll-theme-tactile (0.2.0) + jekyll (> 3.5, < 5.0) + jekyll-seo-tag (~> 2.0) + jekyll-theme-time-machine (0.2.0) + jekyll (> 3.5, < 5.0) + jekyll-seo-tag (~> 2.0) + jekyll-titles-from-headings (0.5.3) + jekyll (>= 3.3, < 5.0) + jekyll-watch (2.2.1) + listen (~> 3.0) + jemoji (0.13.0) + gemoji (>= 3, < 5) + html-pipeline (~> 2.2) + jekyll (>= 3.0, < 5.0) + json (2.13.2) + kramdown (2.4.0) + rexml + kramdown-parser-gfm (1.1.0) + kramdown (~> 2.0) + liquid (4.0.4) + listen (3.9.0) + rb-fsevent (~> 0.10, >= 0.10.3) + rb-inotify (~> 0.9, >= 0.9.10) + logger (1.6.6) + mercenary (0.3.6) + minima (2.5.1) + jekyll (>= 3.5, < 5.0) + jekyll-feed (~> 0.9) + jekyll-seo-tag (~> 2.1) + minitest (5.25.5) + net-http (0.6.0) + uri + nokogiri (1.18.9-aarch64-linux-gnu) + racc (~> 1.4) + nokogiri (1.18.9-aarch64-linux-musl) + racc (~> 1.4) + nokogiri (1.18.9-arm-linux-gnu) + racc (~> 1.4) + nokogiri (1.18.9-arm-linux-musl) + racc (~> 1.4) + nokogiri (1.18.9-arm64-darwin) + racc (~> 1.4) + nokogiri (1.18.9-x86_64-darwin) + racc (~> 1.4) + nokogiri (1.18.9-x86_64-linux-gnu) + racc (~> 1.4) + nokogiri (1.18.9-x86_64-linux-musl) + racc (~> 1.4) + octokit (4.25.1) + faraday (>= 1, < 3) + sawyer (~> 0.9) + pathutil (0.16.2) + forwardable-extended (~> 2.6) + public_suffix (5.1.1) + racc (1.8.1) + rb-fsevent (0.11.2) + rb-inotify (0.11.1) + ffi (~> 1.0) + rexml (3.4.1) + rouge (3.30.0) + rubyzip (2.4.1) + safe_yaml (1.0.5) + sass (3.7.4) + sass-listen (~> 4.0.0) + sass-listen (4.0.0) + rb-fsevent (~> 0.9, >= 0.9.4) + rb-inotify (~> 0.9, >= 0.9.7) + sawyer (0.9.2) + addressable (>= 2.3.5) + faraday (>= 0.17.3, < 3) + securerandom (0.4.1) + simpleidn (0.2.3) + terminal-table (1.8.0) + unicode-display_width (~> 1.1, >= 1.1.1) + typhoeus (1.4.1) + ethon (>= 0.9.0) + tzinfo (2.0.6) + concurrent-ruby (~> 1.0) + unicode-display_width (1.8.0) + uri (1.0.3) + webrick (1.9.1) + +PLATFORMS + aarch64-linux-gnu + aarch64-linux-musl + arm-linux-gnu + arm-linux-musl + arm64-darwin + x86_64-darwin + x86_64-linux-gnu + x86_64-linux-musl + +DEPENDENCIES + github-pages (~> 232) + webrick (~> 1.9) + +BUNDLED WITH + 2.6.8 diff --git a/docs/_config.yml b/docs/_config.yml index 465ef279..61f15523 100644 --- a/docs/_config.yml +++ b/docs/_config.yml @@ -1,12 +1,79 @@ -# Configure generation of web page(s). -name: OpenSSF Security Baseline -title: null +title: Open Source Project Security Baseline +author: + name: OpenSSF Security Baseline SIG + email: openssf-sig-security-baseline+subscribe@lists.openssf.org +logo: /assets/logo.svg +url: "https://baseline.openssf.org" +description: > + The Open Source Project Security (OSPS) Baseline is a set of security + controls that projects should meet to demonstrate a strong security posture. + The controls are organized by maturity level and category. + +titles_from_headings: + enabled: true + strip_title: true + kramdown: toc_levels: "2" -defaults: - - - scope: - path: "" # an empty string here means all files in the project - values: - author: Open Source Security Foundation (OpenSSF) Security Baseline SIG +# Add to plugins: list +plugins: + - jekyll-remote-theme + - jekyll-feed + - jekyll-seo-tag + +remote_theme: jekyll/minima + +# Minima-specific settings (applicable to Minima v3 and above only) +# ----------------------------------------------------------------- +# +# *All described config keys below should be nested under the top-level +# `minima` key.* +# +minima: +# Minima skin selection. Available skins are: +# * classic Default, light color scheme. +# * dark Dark variant of the classic skin. +# * auto Adaptive skin based on the classic and dark skins. +# * solarized-light Light variant of solarized color scheme. +# * solarized-dark Dark variant of solarized color scheme. +# * solarized Adaptive skin for solarized color scheme skins. + skin: classic +# +# Specific pages for site navigation. +# If you wish to link only specific pages in the site-navigation, use this +# and list the `path` property (as represented via Liquid) of the pages in +# the order they should be rendered. + nav_pages: + - index.md + - versions/2025-02-25.md + - faq.md + - maintenance.md +# +# Set to `true` to show excerpts on the homepage. + show_excerpts: false +# +# Minima date format. +# The default value is "%b %d, %Y" (e.g. Nov 14, 2023). +# Refer to https://shopify.github.io/liquid/filters/date/ for valid values +# date_format: "%b-%d-%Y" +# +# Social Media Links. +# Renders icons via Font Awesome Free webfonts CDN, based on ordered list of +# entries. Valid entry keys: +# * title Tooltip rendered on hovering over icon. +# * icon Font Awesome icon id. `github` corresponds to `fa-github`. +# * url Full URL of social profile. + social_links: + - title: OpenSSF GitHub + icon: github + url: "https://github.com/ossf" + - title: OpenSSF at X (formerly Twitter) + icon: x-twitter + url: "https://x.com/openssf" + - title: OpenSSF at BlueSky + icon: bluesky + url: "https://bsky.app/profile/openssf.org" + - title: OpenSSF at LinkedIn + icon: linkedin + url: "https://www.linkedin.com/company/openssf/" \ No newline at end of file diff --git a/docs/_includes/custom-head.html b/docs/_includes/custom-head.html new file mode 100644 index 00000000..d8b5d90f --- /dev/null +++ b/docs/_includes/custom-head.html @@ -0,0 +1,5 @@ + + + diff --git a/docs/_includes/footer.html b/docs/_includes/footer.html new file mode 100644 index 00000000..d03efd7d --- /dev/null +++ b/docs/_includes/footer.html @@ -0,0 +1,38 @@ + + + \ No newline at end of file diff --git a/docs/_includes/header.html b/docs/_includes/header.html new file mode 100644 index 00000000..dda5066e --- /dev/null +++ b/docs/_includes/header.html @@ -0,0 +1,23 @@ +
+
+ {%- assign default_paths = site.pages | map: "path" -%} + {%- assign page_paths = site.minima.nav_pages | default: default_paths -%} + {%- assign page_titles = site.pages | map: 'title' | compact %} + + +
+
+ {%- unless page_titles == empty %} + + {%- endunless %} +
+
\ No newline at end of file diff --git a/docs/_includes/nav-items.html b/docs/_includes/nav-items.html new file mode 100644 index 00000000..eab61b81 --- /dev/null +++ b/docs/_includes/nav-items.html @@ -0,0 +1,10 @@ +
+ {%- for path in include.paths -%} + {%- assign hyperpage = site.pages | where: "path", path | first -%} + {%- if hyperpage.nav-title -%} + {{ hyperpage.nav-title | escape }} + {%- else hyperpage.title -%} + {{ hyperpage.title | escape }} + {%- endif -%} + {%- endfor %} +
\ No newline at end of file diff --git a/docs/_layouts/default.html b/docs/_layouts/default.html index f99ba2a7..244cdabd 100644 --- a/docs/_layouts/default.html +++ b/docs/_layouts/default.html @@ -1,32 +1,27 @@ - - + {% seo %} - - {% include head-custom.html %} + + -
- {% if site.title and site.title != page.title %} -

{{ site.title }}

- {% endif %} - {{ content }} + {%- include header.html -%} -
- Copyright © OSPS Baseline contributors, a Series of LF Projects, LLC. - For website terms of use, trademark policy, and other project policies please see https://lfprojects.org. - This site is open source. View or contribute at GitHub. +
+
+ {{ content }}
-
- - + {%- include footer.html -%} + + + \ No newline at end of file diff --git a/docs/assets/baseline_logo.png b/docs/assets/baseline_logo.png new file mode 100644 index 00000000..e6315a82 Binary files /dev/null and b/docs/assets/baseline_logo.png differ diff --git a/docs/assets/css/style.scss b/docs/assets/css/style.scss index 54fb58f9..463abf22 100644 --- a/docs/assets/css/style.scss +++ b/docs/assets/css/style.scss @@ -1,7 +1,91 @@ --- --- -@import "{{ site.theme }}"; +@import + "minima/skins/{{ site.minima.skin | default: 'auto' }}", + "minima/initialize"; + +/* For information on use Jekyll in GitHub: + https://docs.github.com/en/pages/setting-up-a-github-pages-site-with-jekyll/adding-a-theme-to-your-github-pages-site-using-jekyll +8? +*/ + +/* Use OpenSSF style, see + https://openssf.org/brand-guidelines/ +*/ + +/* Follow OpenSSF CSS view, see https://openssf.org/brand-guidelines/ */ + +body, .markdown-body { + font-family: "Cairo", sans-serif; +} + +h1, h2, h3, h4, h5, h6 { + font-family: "IBMPlexSans", sans-serif; +} + +@font-face { + font-family: "Cairo"; + /* ../assets/fonts/Cairo/Cairo-VariableFont_slnt,wght.ttf"); */ + src: url("/assets/fonts/Cairo/Cairo-VariableFont_slnt,wght.ttf"); +} + +@font-face { + font-family: "IBMPlexSans"; + src: url("/assets/fonts/IBMPlexSans/IBMPlexSans-Regular.ttf"); +} + +/* Increase weight so bold/strong are easier to identify as such. + Without this, Cairo bold looks like unbolded text. +*/ +b, strong { + font-weight: 700; +} + +/* Avoid creating orphans at the bottom of the page when printing. + Firefox 115 doesn't support this, but it will do no harm there. + https://stackoverflow.com/questions/34808650/orphan-css-how-avoid-headers-h1-h2-on-bottom-page + https://caniuse.com/?search=break-after +*/ +h1, h2, h3, h4, h5, h6 { + break-after: avoid-page; +} + +/* Set links to some color listed in the OpenSSF pallette in + * https://openssf.org/about/brand-guidelines/ */ +/* unvisited link */ +a:link { + color: #45208c; +} +/* visited link */ +a:visited { + color: #604693; +} +/* mouse over link */ +a:hover { + color: #170D34; +} +/* selected link */ +a:active { + color: #04ee5f; +} +.header-wrapper { + display: flex; + justify-content: space-between; + align-items: flex-end; + padding-bottom: 10px; +} + +.site-logo { + flex: 0 0 auto; +} + +.site-title { + flex: 1 1 auto; + text-align: right; + margin-bottom: 0; + padding-left: 20px; +} .warning { background: rgba(114, 83, 237, 0.2); diff --git a/docs/assets/favicon.ico b/docs/assets/favicon.ico new file mode 100644 index 00000000..6684ef3c Binary files /dev/null and b/docs/assets/favicon.ico differ diff --git a/docs/assets/fonts/Cairo/Cairo-VariableFont_slnt,wght.ttf b/docs/assets/fonts/Cairo/Cairo-VariableFont_slnt,wght.ttf new file mode 100644 index 00000000..5bdb2a93 Binary files /dev/null and b/docs/assets/fonts/Cairo/Cairo-VariableFont_slnt,wght.ttf differ diff --git a/docs/assets/fonts/Cairo/OFL.txt b/docs/assets/fonts/Cairo/OFL.txt new file mode 100644 index 00000000..f6e87d48 --- /dev/null +++ b/docs/assets/fonts/Cairo/OFL.txt @@ -0,0 +1,93 @@ +Copyright 2009 The Cairo Project Authors (https://github.com/Gue3bara/Cairo) + +This Font Software is licensed under the SIL Open Font License, Version 1.1. +This license is copied below, and is also available with a FAQ at: +http://scripts.sil.org/OFL + + +----------------------------------------------------------- +SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 +----------------------------------------------------------- + +PREAMBLE +The goals of the Open Font License (OFL) are to stimulate worldwide +development of collaborative font projects, to support the font creation +efforts of academic and linguistic communities, and to provide a free and +open framework in which fonts may be shared and improved in partnership +with others. + +The OFL allows the licensed fonts to be used, studied, modified and +redistributed freely as long as they are not sold by themselves. The +fonts, including any derivative works, can be bundled, embedded, +redistributed and/or sold with any software provided that any reserved +names are not used by derivative works. The fonts and derivatives, +however, cannot be released under any other type of license. The +requirement for fonts to remain under this license does not apply +to any document created using the fonts or their derivatives. + +DEFINITIONS +"Font Software" refers to the set of files released by the Copyright +Holder(s) under this license and clearly marked as such. This may +include source files, build scripts and documentation. + +"Reserved Font Name" refers to any names specified as such after the +copyright statement(s). + +"Original Version" refers to the collection of Font Software components as +distributed by the Copyright Holder(s). + +"Modified Version" refers to any derivative made by adding to, deleting, +or substituting -- in part or in whole -- any of the components of the +Original Version, by changing formats or by porting the Font Software to a +new environment. + +"Author" refers to any designer, engineer, programmer, technical +writer or other person who contributed to the Font Software. + +PERMISSION & CONDITIONS +Permission is hereby granted, free of charge, to any person obtaining +a copy of the Font Software, to use, study, copy, merge, embed, modify, +redistribute, and sell modified and unmodified copies of the Font +Software, subject to the following conditions: + +1) Neither the Font Software nor any of its individual components, +in Original or Modified Versions, may be sold by itself. + +2) Original or Modified Versions of the Font Software may be bundled, +redistributed and/or sold with any software, provided that each copy +contains the above copyright notice and this license. These can be +included either as stand-alone text files, human-readable headers or +in the appropriate machine-readable metadata fields within text or +binary files as long as those fields can be easily viewed by the user. + +3) No Modified Version of the Font Software may use the Reserved Font +Name(s) unless explicit written permission is granted by the corresponding +Copyright Holder. This restriction only applies to the primary font name as +presented to the users. + +4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font +Software shall not be used to promote, endorse or advertise any +Modified Version, except to acknowledge the contribution(s) of the +Copyright Holder(s) and the Author(s) or with their explicit written +permission. + +5) The Font Software, modified or unmodified, in part or in whole, +must be distributed entirely under this license, and must not be +distributed under any other license. The requirement for fonts to +remain under this license does not apply to any document created +using the Font Software. + +TERMINATION +This license becomes null and void if any of the above conditions are +not met. + +DISCLAIMER +THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT +OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE +COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, +INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL +DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM +OTHER DEALINGS IN THE FONT SOFTWARE. diff --git a/docs/assets/fonts/Cairo/README.txt b/docs/assets/fonts/Cairo/README.txt new file mode 100644 index 00000000..5c1c74c8 --- /dev/null +++ b/docs/assets/fonts/Cairo/README.txt @@ -0,0 +1,71 @@ +Cairo Variable Font +=================== + +This download contains Cairo as both a variable font and static fonts. + +Cairo is a variable font with these axes: + slnt + wght + +This means all the styles are contained in a single file: + Cairo-VariableFont_slnt,wght.ttf + +If your app fully supports variable fonts, you can now pick intermediate styles +that aren’t available as static fonts. Not all apps support variable fonts, and +in those cases you can use the static font files for Cairo: + static/Cairo-ExtraLight.ttf + static/Cairo-Light.ttf + static/Cairo-Regular.ttf + static/Cairo-Medium.ttf + static/Cairo-SemiBold.ttf + static/Cairo-Bold.ttf + static/Cairo-ExtraBold.ttf + static/Cairo-Black.ttf + +Get started +----------- + +1. Install the font files you want to use + +2. Use your app's font picker to view the font family and all the +available styles + +Learn more about variable fonts +------------------------------- + + https://developers.google.com/web/fundamentals/design-and-ux/typography/variable-fonts + https://variablefonts.typenetwork.com + https://medium.com/variable-fonts + +In desktop apps + + https://theblog.adobe.com/can-variable-fonts-illustrator-cc + https://helpx.adobe.com/nz/photoshop/using/fonts.html#variable_fonts + +Online + + https://developers.google.com/fonts/docs/getting_started + https://developer.mozilla.org/en-US/docs/Web/CSS/CSS_Fonts/Variable_Fonts_Guide + https://developer.microsoft.com/en-us/microsoft-edge/testdrive/demos/variable-fonts + +Installing fonts + + MacOS: https://support.apple.com/en-us/HT201749 + Linux: https://www.google.com/search?q=how+to+install+a+font+on+gnu%2Blinux + Windows: https://support.microsoft.com/en-us/help/314960/how-to-install-or-remove-a-font-in-windows + +Android Apps + + https://developers.google.com/fonts/docs/android + https://developer.android.com/guide/topics/ui/look-and-feel/downloadable-fonts + +License +------- +Please read the full license text (OFL.txt) to understand the permissions, +restrictions and requirements for usage, redistribution, and modification. + +You can use them in your products & projects – print or digital, +commercial or otherwise. + +This isn't legal advice, please consider consulting a lawyer and see the full +license for all details. diff --git a/docs/assets/fonts/Cairo/static/Cairo-Black.ttf b/docs/assets/fonts/Cairo/static/Cairo-Black.ttf new file mode 100644 index 00000000..4a6334ed Binary files /dev/null and b/docs/assets/fonts/Cairo/static/Cairo-Black.ttf differ diff --git a/docs/assets/fonts/Cairo/static/Cairo-Bold.ttf b/docs/assets/fonts/Cairo/static/Cairo-Bold.ttf new file mode 100644 index 00000000..098d2fb5 Binary files /dev/null and b/docs/assets/fonts/Cairo/static/Cairo-Bold.ttf differ diff --git a/docs/assets/fonts/Cairo/static/Cairo-ExtraBold.ttf b/docs/assets/fonts/Cairo/static/Cairo-ExtraBold.ttf new file mode 100644 index 00000000..284da170 Binary files /dev/null and b/docs/assets/fonts/Cairo/static/Cairo-ExtraBold.ttf differ diff --git a/docs/assets/fonts/Cairo/static/Cairo-ExtraLight.ttf b/docs/assets/fonts/Cairo/static/Cairo-ExtraLight.ttf new file mode 100644 index 00000000..dc490ab5 Binary files /dev/null and b/docs/assets/fonts/Cairo/static/Cairo-ExtraLight.ttf differ diff --git a/docs/assets/fonts/Cairo/static/Cairo-Light.ttf b/docs/assets/fonts/Cairo/static/Cairo-Light.ttf new file mode 100644 index 00000000..3c40958c Binary files /dev/null and b/docs/assets/fonts/Cairo/static/Cairo-Light.ttf differ diff --git a/docs/assets/fonts/Cairo/static/Cairo-Medium.ttf b/docs/assets/fonts/Cairo/static/Cairo-Medium.ttf new file mode 100644 index 00000000..38d28349 Binary files /dev/null and b/docs/assets/fonts/Cairo/static/Cairo-Medium.ttf differ diff --git a/docs/assets/fonts/Cairo/static/Cairo-Regular.ttf b/docs/assets/fonts/Cairo/static/Cairo-Regular.ttf new file mode 100644 index 00000000..fb9e6cc6 Binary files /dev/null and b/docs/assets/fonts/Cairo/static/Cairo-Regular.ttf differ diff --git a/docs/assets/fonts/Cairo/static/Cairo-SemiBold.ttf b/docs/assets/fonts/Cairo/static/Cairo-SemiBold.ttf new file mode 100644 index 00000000..e2b82ba3 Binary files /dev/null and b/docs/assets/fonts/Cairo/static/Cairo-SemiBold.ttf differ diff --git a/docs/assets/fonts/IBMPlexSans/IBMPlexSans-Bold.ttf b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-Bold.ttf new file mode 100644 index 00000000..e5389d83 Binary files /dev/null and b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-Bold.ttf differ diff --git a/docs/assets/fonts/IBMPlexSans/IBMPlexSans-BoldItalic.ttf b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-BoldItalic.ttf new file mode 100644 index 00000000..31cce79b Binary files /dev/null and b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-BoldItalic.ttf differ diff --git a/docs/assets/fonts/IBMPlexSans/IBMPlexSans-ExtraLight.ttf b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-ExtraLight.ttf new file mode 100644 index 00000000..ecd3aff2 Binary files /dev/null and b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-ExtraLight.ttf differ diff --git a/docs/assets/fonts/IBMPlexSans/IBMPlexSans-ExtraLightItalic.ttf b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-ExtraLightItalic.ttf new file mode 100644 index 00000000..5bbda2cc Binary files /dev/null and b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-ExtraLightItalic.ttf differ diff --git a/docs/assets/fonts/IBMPlexSans/IBMPlexSans-Italic.ttf b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-Italic.ttf new file mode 100644 index 00000000..46212a3d Binary files /dev/null and b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-Italic.ttf differ diff --git a/docs/assets/fonts/IBMPlexSans/IBMPlexSans-Light.ttf b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-Light.ttf new file mode 100644 index 00000000..b3d035d5 Binary files /dev/null and b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-Light.ttf differ diff --git a/docs/assets/fonts/IBMPlexSans/IBMPlexSans-LightItalic.ttf b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-LightItalic.ttf new file mode 100644 index 00000000..20bb6cfc Binary files /dev/null and b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-LightItalic.ttf differ diff --git a/docs/assets/fonts/IBMPlexSans/IBMPlexSans-Medium.ttf b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-Medium.ttf new file mode 100644 index 00000000..9395402b Binary files /dev/null and b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-Medium.ttf differ diff --git a/docs/assets/fonts/IBMPlexSans/IBMPlexSans-MediumItalic.ttf b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-MediumItalic.ttf new file mode 100644 index 00000000..7787ad27 Binary files /dev/null and b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-MediumItalic.ttf differ diff --git a/docs/assets/fonts/IBMPlexSans/IBMPlexSans-Regular.ttf b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-Regular.ttf new file mode 100644 index 00000000..b5819647 Binary files /dev/null and b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-Regular.ttf differ diff --git a/docs/assets/fonts/IBMPlexSans/IBMPlexSans-SemiBold.ttf b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-SemiBold.ttf new file mode 100644 index 00000000..a5bd9ee6 Binary files /dev/null and b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-SemiBold.ttf differ diff --git a/docs/assets/fonts/IBMPlexSans/IBMPlexSans-SemiBoldItalic.ttf b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-SemiBoldItalic.ttf new file mode 100644 index 00000000..a5bcdc40 Binary files /dev/null and b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-SemiBoldItalic.ttf differ diff --git a/docs/assets/fonts/IBMPlexSans/IBMPlexSans-Thin.ttf b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-Thin.ttf new file mode 100644 index 00000000..910458a9 Binary files /dev/null and b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-Thin.ttf differ diff --git a/docs/assets/fonts/IBMPlexSans/IBMPlexSans-ThinItalic.ttf b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-ThinItalic.ttf new file mode 100644 index 00000000..d5b4be65 Binary files /dev/null and b/docs/assets/fonts/IBMPlexSans/IBMPlexSans-ThinItalic.ttf differ diff --git a/docs/assets/fonts/NOTES.txt b/docs/assets/fonts/NOTES.txt new file mode 100644 index 00000000..59aadf4a --- /dev/null +++ b/docs/assets/fonts/NOTES.txt @@ -0,0 +1,14 @@ +Sources: + +* https://fonts.google.com/specimen/Cairo + - Cairo is used for body copy, per + https://openssf.org/brand-guidelines/ + +* https://fonts.google.com/specimen/IBM+Plex+Sans + - Licensed under the Open Font License (OFL) + - IBM Plex Sans is used for headlines per + https://openssf.org/brand-guidelines/ + +* https://fonts.google.com/specimen/Teko + - This *was* the recommended heading font, but is no longer. + Many found it hard to read. diff --git a/docs/assets/logo.svg b/docs/assets/logo.svg new file mode 100644 index 00000000..c98a4d25 --- /dev/null +++ b/docs/assets/logo.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/docs/index.md b/docs/index.md index 7c1407b2..73fb1a79 100644 --- a/docs/index.md +++ b/docs/index.md @@ -1,6 +1,11 @@ +--- +nav-title: About +--- + # Open Source Project Security Baseline -The Open Source Project Security Baseline (OSPS Baseline) is designed to act as a minimum definition of requirements for a project relative to it's maturity level. +OSPS Baseline Logo +The Open Source Project Security Baseline (OSPS Baseline) is designed to act as a minimum definition of requirements for a project relative to its maturity level. It is maintained by the [OpenSSF Security Baseline SIG](https://github.com/ossf/security-baseline/blob/main/governance/MAINTAINERS.md) according to the [project governance documentation](https://github.com/ossf/security-baseline/blob/main/governance/GOVERNANCE.md). For more information on the motivation and purpose, see the [FAQ](faq). diff --git a/docs/maintenance.md b/docs/maintenance.md index ea774cc4..85861d68 100644 --- a/docs/maintenance.md +++ b/docs/maintenance.md @@ -1,3 +1,7 @@ +--- +nav-title: Maintenance Process +--- + # OSPS Baseline Maintenance Process * Normal text fixes to the controls will be accepted via pull request and reviewed by the baseline project maintainers. diff --git a/docs/versions/2025-02-25.md b/docs/versions/2025-02-25.md index 718394e4..cd1fbfea 100644 --- a/docs/versions/2025-02-25.md +++ b/docs/versions/2025-02-25.md @@ -1,3 +1,7 @@ +--- +nav-title: Current Version +--- + # Open Source Project Security Baseline Version: 2025-02-25