slsa-github-generator

slsa-github-generator copied to clipboard

Remove Dockerfile from detect-workflow action

2

See https://github.com/slsa-framework/slsa-github-generator/pull/35/files#r858908103 Something to try.

laurentsimon

[bug] Improve Scorecard score

8

**Describe the bug** Improve repository's OpenSSF Scorecard score (currently at 7.1) **To Reproduce** `docker run -e GITHUB_AUTH_TOKEN gcr.io/openssf/scorecard:stable --show-details --repo=https://github.com/slsa-framework/slsa-github-generator --format=json > scorecard_slsa-framework_slsa-github-generator.json` **Expected behavior** - Branch Protections could be...

melba-lopez

Leaks of: 1. `GITHUB_TOKEN` which allows requesting certs from Fulcio. Not sure yet what we can do here, besides hardening our implementation and verifying that the keys don't leak in...

laurentsimon

The go project does support hermeticity at the moment by building in 2 steps: 1. Vendoring `go mod vendor` 2. Build with `go build --mod=vendor` However we currently: 1. Do...

laurentsimon

Create an -installer action to invoke in reusable workflows

5

asraa

Generic provenance: support for container registries

12

We may want to make it easier for users to generate/upload provenance on a registry. Either we do the upload for them, or we properly document how to do it...

laurentsimon

Fix missing digest input and update attestation

1

This Pull Request: - adds the digest input - Fix: attestation generation (adds the missing subjects) - remove already set env variables co-authored-by @jobroe10 We made these changes while using...

Root-DE

[docs] Verification with Connaisseur

4

Document examples using [Connaisseur](https://sse-secure-systems.github.io/connaisseur/v2.6.1/) to verify provenance.

ianlewis

ianlewis

[feature] Add a security policy file

4

I'm not sure this should be handled via an OSSF-org policy or if individual projects needs their own. @david-a-wheeler can you advise?

laurentsimon