Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Clarify external workflow. Fixes #63 #103

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Clarify external workflow. Fixes #63 #103

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e312853
Clarify external workflow. Fixes #63
david-a-wheeler Dec 10, 2024
4a92f10
Update baseline.yaml
david-a-wheeler Dec 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 7 additions & 5 deletions baseline.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,18 +129,20 @@ criteria:
maturity_level: 1
category: Build & Release
criteria: |
The project's build and release pipelines
MUST NOT execute arbitrary code that is
input from outside of the build script.
A build process that either leads to release or can read secret data
MUST NOT execute untrusted code.
Comment on lines +132 to +133
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We'd also need to cover any build pipelines that produce artifacts that would be used on a system that might contain sensitive information, such as an end user or developer machine. 🤔 Effectively any pipeline that produces any artifact that could be used by any machine that isn't ephemeral.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would this work?: s/secret/sensitive/

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Or, s/secret/secret or sensitive/

objective: |
Reduce the risk of code injection or other
security vulnerabilities in the project's
build and release processes by restricting
the execution of external code.
the execution of external code in workflows.
implementation: |
Ensure that the project's build and release
pipelines do not execute arbitrary code
pipelines do not execute untrusted code
provided from external sources.
One approach is to only allow maintainers to identify
which external code can be used, using verification mechanisms
such as digital signatures or https.
control_mappings: # TODO
scorecard_probe:
- hasDangerousWorkflowScriptInjection
Expand Down
Loading