Repository navigation
CNCF Defender Tasks for devfile/alizer #1392
Description
Activity
Defender tasks with the same checklist items were sized as Major with 5 story points. Assigning this the same and moving to backlog.
As discussed the security policy will be covered after the completion of #1461. We might need to ignore for now the following checks:
- Software Bill of Materials (SBOM)
- Signed Releases
- Token Permissions
cc @Jdubrick @michael-valdron
Reacted by Michael Valdron and Jordan DubrickAs discussed the security policy will be covered after the completion of #1461. We might need to ignore for now the following checks:
- Software Bill of Materials (SBOM)
- Signed Releases
- Token Permissions
cc @thepetk @michael-valdron
Are these checks being ignored for now as in leaving unchecked or should a discussion be had for exemption them from the checks? Also, would that be relevant for all repos covered under #1297
As discussed the security policy will be covered after the completion of #1461. We might need to ignore for now the following checks:
- Software Bill of Materials (SBOM)
- Signed Releases
- Token Permissions
cc @thepetk @michael-valdron
Are these checks being ignored for now as in leaving unchecked or should a discussion be had for exemption them from the checks? Also, would that be relevant for all repos covered under #1297
I think we can revisit the topic in a future devtools week. So I'd say we can:
- Close the parent epic and all the children issues when the
Dependencies Policy,Dependency Update Tool&Security Insightsare covered. - Create a new epic for future work around
SBOMs,Signed ReleasesandToken Permissions. - The
Security PolicyCheck is included here: Create Security Policy for the Devfiles Org #1461
WDYT?
Reacted by Jordan Dubrick and Michael ValdronAs discussed the security policy will be covered after the completion of #1461. We might need to ignore for now the following checks:
- Software Bill of Materials (SBOM)
- Signed Releases
- Token Permissions
Are these checks being ignored for now as in leaving unchecked or should a discussion be had for exemption them from the checks? Also, would that be relevant for all repos covered under #1297
I think we can revisit the topic in a future devtools week. So I'd say we can:
- Close the parent epic and all the children issues when the
Dependencies Policy,Dependency Update Tool&Security Insightsare covered. - Create a new epic for future work around
SBOMs,Signed ReleasesandToken Permissions. - The
Security PolicyCheck is included here: Create Security Policy for the Devfiles Org #1461
WDYT?
I think that is a good idea. I will create an epic and initial investigation issue for
SBOM,Signed ReleasesandToken Permissionsthat we can refer to.Epic created here with initial spike: #1465
Reacted by Michael Valdron
Metadata
Metadata
Assignees
Type
Projects
- Status
Which area/kind this issue is related to?
/area alizer
Issue Description
As part of our effort to maintain best practices we have added all of our repositories to the CLO Monitor. This issue aims to resolve the checks needed for our repositories to reach 100% on the monitor.
A list of the checks for each check set can be found here: https://clomonitor.io/docs/topics/checks/
Remaining Items
Security