Posts Tagged ‘scorecard’
What? Let’s get the terminology cleared up. This post is about: Software Bill of Materials (SBOM) – the idea that you write down what’s inside the software you’re shipping (in a standarised form) so that people can figure out what vulnerabilities might be in there and make risk decisions based on that insight. Supply-chain Levels […]
Filed under: security | 3 Comments
Tags: OpenSSF, sbom, scorecard, security, slsa, supply chain
TL;DR pymarkdownlnt provides an easy way of checking that any Markdown you’re working on is complying to some sensible guidelines. If you’re comfortable with Python virtual environments you won’t really need the rest of this post. Why? I’ve spent a bunch of time recently adding OpenSSF Scorecards to the key Atsign repos. Build better security […]
Filed under: howto | Leave a Comment
Tags: Actions, github, lint, lints, Markdown, Pip, pymarkdown, pymarkdownlnt, python, scorecard, Ubuntu, uv, venv, venvs, virtual environment
TL;DR OSSF Scorecards provide a visible badge that lets people see that an open source repo is adhering to a set of practices that minimise risks, measured by a set of automated checks. Getting this right for a single repo can be an involved process, but with that experience in hand applying the learning to […]
Filed under: security, software | Leave a Comment
Tags: Allstar, CI, github, OSSF, scorecard, security
