Skip to content

Commit e5a8666

Browse files
committed
Add version to Principles for Package Repository Security.
Also add link to give feedback to v0.2. Signed-off-by: Zach Steindler <[email protected]>
1 parent 393edd5 commit e5a8666

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

docs/principles-for-package-repository-security.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
# Principles for Package Repository Security
22

33
Authors: [Jack Cable (CISA)](https://github.com/cablej), [Zach Steindler](https://github.com/steiza)
4+
45
Last updated: Feb 2024
56

67
## Background
@@ -13,6 +14,8 @@ We include the below taxonomy because not all security advice applies to all pac
1314

1415
The roadmap of security capabilities can then be used by package repositories to assess gaps, put together fundable improvement lists ([like Python Packaging WG](https://github.com/psf/fundable-packaging-improvements/blob/master/FUNDABLES.md)), or write specific grant proposals that reference this guidance.
1516

17+
This is v0.1 of this document. You can give feedback for v0.2 at https://github.com/ossf/wg-securing-software-repos/pull/38.
18+
1619
## Taxonomy of Package Repositories
1720

1821
Security capabilities will differ based on the services that the package repository offers. For instance, if the package repository has user accounts, it will need to enforce authentication securely. In this section, we lay out the various relevant aspects of package repositories.

0 commit comments

Comments
 (0)