Security fixes: cryptography CVE-2026-69247 and other dependency patches

.env.example

@@ -12,3 +12,7 @@ GEMINI_API_KEY=
 # Optional
 NVD_API_KEY=
 SENTRY_DSN=
+
+# Optional - enables AZ-SC-007/008 (Azure DevOps pipeline scanning)
+AZURE_DEVOPS_ORG_URL=
+AZURE_DEVOPS_PROJECT=

.github/PULL_REQUEST_TEMPLATE.md

@@ -26,6 +26,7 @@
 Closes #
 
 ## Checklist
+- [ ] Every commit includes a DCO `Signed-off-by` trailer (`git commit -s`; see `docs/dco.md`)
 - [ ] My code follows the rule template in CONTRIBUTING.md
 - [ ] I added or updated the matching CLI playbook
 - [ ] I added or updated all four compliance framework mappings

.github/workflows/ci.yml

@@ -595,7 +595,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: "22"
+          node-version: "22.22.0"
           cache: npm
           cache-dependency-path: frontend/package-lock.json
 
@@ -608,6 +608,9 @@ jobs:
       - name: Run aiSettings tests
         run: node src/utils/aiApi.test.mjs
 
+      - name: Run accessibility and internationalization checks
+        run: npm run test:a11y && npm run test:i18n
+
       - name: Build
         run: npm run build
 

.github/workflows/dco.yml

@@ -0,0 +1,24 @@
+name: Developer Certificate of Origin
+
+on:
+  pull_request:
+    branches: [dev, main]
+
+permissions:
+  contents: read
+
+jobs:
+  signoff:
+    name: DCO sign-off
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout pull request history
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 0
+
+      - name: Verify every pull request commit
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: python scripts/check_dco.py "$BASE_SHA" "$HEAD_SHA"

.github/workflows/release.yml

@@ -1,21 +1,85 @@
-name: Release
+name: Signed Release
 
 on:
   push:
     tags:
-      - 'v*'
+      - "v*"
 
 permissions:
   contents: write
+  id-token: write
+  attestations: write
 
 jobs:
   release:
     runs-on: ubuntu-latest
+    env:
+      TAG: ${{ github.ref_name }}
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - name: Checkout signed tag
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
-      - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
+
+      - name: Verify annotated tag signature
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          tag_object=$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${TAG}" --jq '.object.sha')
+          object_type=$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${TAG}" --jq '.object.type')
+          if [ "$object_type" != "tag" ]; then
+            echo "Release tags must be signed annotated tags; ${TAG} is ${object_type}."
+            exit 1
+          fi
+          verified=$(gh api "repos/${GITHUB_REPOSITORY}/git/tags/${tag_object}" --jq '.verification.verified')
+          if [ "$verified" != "true" ]; then
+            echo "GitHub could not verify the signature on ${TAG}."
+            exit 1
+          fi
+
+      - name: Install Syft
+        env:
+          SYFT_VERSION: "1.46.0"
+          SYFT_SHA256: d654f678b709eb53c393d38519d5ed7d2e57205529404018614cfefa0fb2b5ca
+        run: |
+          set -euo pipefail
+          archive="syft_${SYFT_VERSION}_linux_amd64.tar.gz"
+          curl --fail --silent --show-error --location \
+            --output "$archive" \
+            "https://github.com/anchore/syft/releases/download/v${SYFT_VERSION}/${archive}"
+          echo "${SYFT_SHA256}  ${archive}" | sha256sum --check --strict
+          sudo tar --extract --gzip --file "$archive" --directory /usr/local/bin syft
+
+      - name: Build deterministic release artifacts
+        run: |
+          set -euo pipefail
+          mkdir -p dist
+          syft dir:. --source-name openshield --source-version "$TAG" \
+            -o "cyclonedx-json=dist/openshield-${TAG}-sbom.cyclonedx.json"
+          git archive --format=tar --prefix="openshield-${TAG}/" "$TAG" | \
+            gzip --no-name > "dist/openshield-${TAG}.tar.gz"
+          cd dist
+          sha256sum "openshield-${TAG}.tar.gz" "openshield-${TAG}-sbom.cyclonedx.json" > SHA256SUMS
+
+      - name: Attest source archive
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        with:
+          subject-path: dist/openshield-${{ env.TAG }}.tar.gz
+
+      - name: Attest SBOM
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        with:
+          subject-path: dist/openshield-${{ env.TAG }}-sbom.cyclonedx.json
+
+      - name: Attest checksum manifest
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        with:
+          subject-path: dist/SHA256SUMS
+
+      - name: Publish release
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           generate_release_notes: true
           make_latest: true
+          files: dist/*

.gitignore

@@ -219,3 +219,6 @@ __marimo__/
 ai/vectorstore/
 .vercel
 .env*
+
+# Node (root package.json exists solely to track react-router for Dependabot)
+node_modules/

CHANGELOG.md

@@ -26,6 +26,7 @@ OpenShield uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### Security
 
+- Upgraded cryptography to 50.0.0 to address CVE-2026-69247
 - AI provider errors no longer expose upstream response details
 - Request body limits, AI rate limiting, and playbook path validation added
 - GitHub Actions dependencies pinned to immutable commit SHAs

CONTRIBUTING.md

@@ -50,13 +50,9 @@ from typing import Any, Dict, List
 
 RULE_ID = "AZ-STOR-001"
 RULE_NAME = "Public Blob Access Enabled on Storage Account"
-SEVERITY = "HIGH"           # HIGH / MEDIUM / LOW / INFO
-CATEGORY = "Storage"        # Storage / Network / Identity / Database / Compute / Key Vault / Kubernetes
-FRAMEWORKS = {
-    "CIS": "3.5",
-    "NIST": "PR.AC-3",
-    "ISO27001": "A.9.4.1"
-}
+SEVERITY = "HIGH"  # HIGH / MEDIUM / LOW / INFO
+CATEGORY = "Storage"  # Storage / Network / Identity / Database / Compute / Key Vault / Kubernetes
+FRAMEWORKS = {"CIS": "3.5", "NIST": "PR.AC-3", "ISO27001": "A.9.4.1"}
 DESCRIPTION = (
     "Storage accounts with public blob access enabled allow anyone on the "
     "internet to read data without authentication. This can lead to data "
@@ -72,20 +68,22 @@ def scan(azure_client: Any, subscription_id: str) -> List[Dict[str, Any]]:
 
     for account in azure_client.get_storage_accounts():
         if getattr(account, "allow_blob_public_access", False):
-            findings.append({
-                "rule_id": RULE_ID,
-                "rule_name": RULE_NAME,
-                "severity": SEVERITY,
-                "category": CATEGORY,
-                "resource_id": account.id,
-                "resource_name": account.name,
-                "resource_type": "Microsoft.Storage/storageAccounts",
-                "description": DESCRIPTION,
-                "remediation": REMEDIATION,
-                "playbook": PLAYBOOK,
-                "frameworks": FRAMEWORKS,
-                "metadata": {}
-            })
+            findings.append(
+                {
+                    "rule_id": RULE_ID,
+                    "rule_name": RULE_NAME,
+                    "severity": SEVERITY,
+                    "category": CATEGORY,
+                    "resource_id": account.id,
+                    "resource_name": account.name,
+                    "resource_type": "Microsoft.Storage/storageAccounts",
+                    "description": DESCRIPTION,
+                    "remediation": REMEDIATION,
+                    "playbook": PLAYBOOK,
+                    "frameworks": FRAMEWORKS,
+                    "metadata": {},
+                }
+            )
 
     return findings
 ```

README.md

@@ -6,6 +6,9 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![CHANGELOG](https://img.shields.io/badge/changelog-here-blue)](CHANGELOG.md)
 
+Release artifacts include SHA-256 checksums, an SBOM, and identity-bound
+provenance attestations. See [release verification](docs/release-verification.md).
+
 > **Open source Cloud Security Posture Management (CSPM) for Azure - detect misconfigurations, map to CIS/NIST/ISO27001/SOC2, fix them with one command, and identify cryptographic assets requiring quantum-safe migration.**
 
 [![GitHub Repo stars](https://img.shields.io/github/stars/openshield-org/openshield?style=flat-square)](https://github.com/openshield-org/openshield/stargazers)

compliance/frameworks/cis_azure_benchmark.json

@@ -287,6 +287,46 @@
       "control_id": "TBD-IDN-015",
       "control_name": "Managed Identity least privilege (not mapped in CIS Azure Foundations 2.0.0)",
       "description": "Microsoft recommends least-privilege roles and scopes for managed identities. This check has no direct control in the repository's CIS Azure Foundations 2.0.0 benchmark."
+    },
+    "AZ-SC-001": {
+      "control_id": "TBD-SC-001",
+      "control_name": "Container Registry Admin User Enabled placeholder",
+      "description": "Numbered placeholder pending maintainer approval of a direct CIS mapping."
+    },
+    "AZ-SC-002": {
+      "control_id": "TBD-SC-002",
+      "control_name": "Container Registry Public Network Access Enabled placeholder",
+      "description": "Numbered placeholder pending maintainer approval of a direct CIS mapping."
+    },
+    "AZ-SC-003": {
+      "control_id": "TBD-SC-003",
+      "control_name": "Container Registry Allows Anonymous Pull placeholder",
+      "description": "Numbered placeholder pending maintainer approval of a direct CIS mapping."
+    },
+    "AZ-SC-004": {
+      "control_id": "TBD-SC-004",
+      "control_name": "Container Registry Missing Retention or Quarantine Policy placeholder",
+      "description": "Numbered placeholder pending maintainer approval of a direct CIS mapping."
+    },
+    "AZ-SC-005": {
+      "control_id": "TBD-SC-005",
+      "control_name": "Terraform State Storage Container Publicly Readable placeholder",
+      "description": "Numbered placeholder pending maintainer approval of a direct CIS mapping."
+    },
+    "AZ-SC-006": {
+      "control_id": "TBD-SC-006",
+      "control_name": "Terraform State Storage Account Missing Versioning or Soft Delete placeholder",
+      "description": "Numbered placeholder pending maintainer approval of a direct CIS mapping."
+    },
+    "AZ-SC-007": {
+      "control_id": "TBD-SC-007",
+      "control_name": "Pipeline Service Connection Scoped to Subscription placeholder",
+      "description": "Numbered placeholder pending maintainer approval of a direct CIS mapping."
+    },
+    "AZ-SC-008": {
+      "control_id": "TBD-SC-008",
+      "control_name": "Pipeline Service Connection Uses Password Instead of Federated Credential placeholder",
+      "description": "Numbered placeholder pending maintainer approval of a direct CIS mapping."
     }
   }
 }

compliance/frameworks/iso27001.json

@@ -287,6 +287,46 @@
       "control_id": "A.9.2.3",
       "control_name": "Management of privileged access rights",
       "description": "Subscription Owner and Contributor assignments to managed identities require least-privilege reduction."
+    },
+    "AZ-SC-001": {
+      "control_id": "A.9.2.1",
+      "control_name": "User registration and de-registration",
+      "description": "The Container Registry admin user is enabled, providing a shared credential that bypasses individual identity management and cannot be attributed to a single user."
+    },
+    "AZ-SC-002": {
+      "control_id": "A.13.1.1",
+      "control_name": "Network controls",
+      "description": "The Container Registry is reachable from the public internet, leaving the network boundary that protects the organization's built container images uncontrolled."
+    },
+    "AZ-SC-003": {
+      "control_id": "A.9.2.1",
+      "control_name": "User registration and de-registration",
+      "description": "The Container Registry allows anonymous pull, letting any client access every image without an authenticated, individually attributable identity."
+    },
+    "AZ-SC-004": {
+      "control_id": "A.12.1.2",
+      "control_name": "Change management",
+      "description": "The Container Registry has no retention or quarantine policy, so stale images accumulate and newly pushed images are deployable before any vulnerability scan evaluates them."
+    },
+    "AZ-SC-005": {
+      "control_id": "A.13.1.1",
+      "control_name": "Network controls",
+      "description": "A Terraform remote state container is publicly readable, leaving the network boundary around infrastructure layout and captured secrets uncontrolled."
+    },
+    "AZ-SC-006": {
+      "control_id": "A.12.3.1",
+      "control_name": "Information backup",
+      "description": "A storage account holding Terraform remote state has neither versioning nor soft delete enabled, so an overwritten or deleted state file cannot be recovered."
+    },
+    "AZ-SC-007": {
+      "control_id": "A.9.2.3",
+      "control_name": "Management of privileged access rights",
+      "description": "A pipeline service connection is scoped to the entire subscription rather than a single resource group, so every pipeline that uses it inherits subscription-wide access beyond what it needs."
+    },
+    "AZ-SC-008": {
+      "control_id": "A.9.4.3",
+      "control_name": "Password management system",
+      "description": "A pipeline service connection authenticates with a stored service principal secret instead of a federated credential, leaving a static credential to rotate and potentially leak."
     }
   }
 }