You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@adityasaky had a good suggestion that the state of what is created/managed by skootrs for a project can be stored in the github repo in something like a .skootrs file or directory (similar to allstar) instead of storing the state in a local database. The data would probably include things like:
Facets created
Parameters to generate the facets (e.g. where they are located in the repo)
Important into of non-file facets (e.g. important API call response info if relevant or perhaps a call that can be run to validate that the functionality enabled by that api call like branch protection is still enabled?)
Hashes of the files created. This is useful for just verifying if a facet has been modified out of band
Commit hash of when the file was committed. This is useful for audits so you have a record of when a facet was enabled.
What properties a facet hits, e.g. this workflow facet include SLSA builder, SBOM generator, etc.
This is useful for a few reasons. I am assuming that no one is abusing .skootrs by modifying it out of band.
This lets skootrs be able to continually manage a project. Since Skootrs can verify the state of a repository and know what it needs to change.
This lets folks adopt new projects into a local reference cache. For example if someone changes workstations or if multiple people have access to manage a project.
This lets external parties run audits against the .skootrs state. This is untrustworthy until multiple security considerations are sorted out.
The text was updated successfully, but these errors were encountered:
@adityasaky had a good suggestion that the state of what is created/managed by skootrs for a project can be stored in the github repo in something like a
.skootrs
file or directory (similar to allstar) instead of storing the state in a local database. The data would probably include things like:This is useful for a few reasons. I am assuming that no one is abusing .skootrs by modifying it out of band.
.skootrs
state. This is untrustworthy until multiple security considerations are sorted out.The text was updated successfully, but these errors were encountered: