OpenSSF Best Practices badge: security policy, contributing, governance, assurance case; Credo, audit and DCO in CI - #3
Merged
Conversation
…project 14775); no code change
Pages: SECURITY.md (private reporting through GitHub Security Advisories or the maintainer's
address; 7-day acknowledgement and 30-day assessment, as beam_mcp's; what a host can rely on;
one known limit stated, below), CONTRIBUTING.md (setup, DCO, tests with behaviour, the style
guide named), CODE_OF_CONDUCT.md (Contributor Covenant 2.1, CC-BY-4.0 text in LICENSES/),
GOVERNANCE.md (roles; beam_mcp's governance and succession apply), and docs/: architecture,
assurance case (threat model, trust boundaries, design principles, CWE weaknesses), roadmap,
verifying a release (the tag key's fingerprint; both tags are signed). All in the docs extras.
The known limit, found by this work's crypto audit: a call that breaks the documented types
raises FunctionClauseError, and Elixir prints the arguments, the key among them. Measured:
sign("bytes", %{private_key: key}) prints the 32 bytes. beam_mcp's Canonical.signature/3 has
the same shape before it reaches this package. The fix is a contract decision across both
packages and is not made here; SECURITY.md, the assurance case and the roadmap say so.
Checks: Credo --strict as a dev/test dependency with UnsafeToAtom and LeakyEnvironment on lib/
(credo 1.7.19, core's version), mix hex.audit, and beam_mcp's DCO job, in CI on the same three
pairs; Dependabot for Mix and Actions. tools/release_tarball.sh is beam_mcp's script; files:
is globs. Local: format ok, compile --warnings-as-errors ok, credo "found no issues", hex.audit
"No retired or security advisory packages found", 10 tests, 0 failures, docs no warnings.
Signed-off-by: Ayla Croft <aylacroft@proton.me>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The project pages and CI checks for the OpenSSF Best Practices badge (bestpractices.dev project 14775). No code change.
Added: SECURITY.md, CONTRIBUTING.md, CODE_OF_CONDUCT.md (Contributor Covenant 2.1, CC-BY-4.0 in
LICENSES/), GOVERNANCE.md, anddocs/(architecture, assurance case, roadmap, verifying a release). CI:mix credo --strict,mix hex.audit, and beam_mcp's DCO job; Dependabot for Mix and Actions.tools/release_tarball.sh(beam_mcp's script) withfiles:as globs: built on ext4 and on tmpfs from 88453d8, both172fb7d7a223edd4a46483ad18d50202c13a459d4d864ab99cc8e37e2e393abc.One known limit, stated, not fixed here: a call that breaks the documented types raises FunctionClauseError, and Elixir prints the arguments, the private key among them (measured:
sign("bytes", %{private_key: key})prints the 32 bytes). beam_mcp'sCanonical.signature/3has the same shape. The fix (answer misuse with an error term that echoes nothing, or take the key by reference) changes both packages' contracts and waits on the maintainer's decision. SECURITY.md, the assurance case and the roadmap name it.Local: format ok; compile --warnings-as-errors ok; credo "found no issues"; hex.audit "No retired or security advisory packages found"; 10 tests, 0 failures; docs without warnings.
Before merging: turn on private vulnerability reporting in this repository's settings, so SECURITY.md's link opens the form.