From b58511833f6c99fe5a2bb54564210baf09abd043 Mon Sep 17 00:00:00 2001 From: Pranav Verma Date: Sat, 17 Oct 2026 13:59:41 +0000 Subject: [PATCH] Record v0.1.0 and branch protection in the roadmap and assurance docs --- docs/ROADMAP.md | 2 +- docs/assurance.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md index 18b40ee..579f75d 100644 --- a/docs/ROADMAP.md +++ b/docs/ROADMAP.md @@ -34,7 +34,7 @@ These are goals to be confirmed by measurement, not claims. - [x] **3a. Lab design and tooling**: a Log4j 2.14.1 canary with a hermetic JNDI hook, a logging-only listener, the `labrun` differential runner, a verified host-side bundle, and [docs/lab.md](lab.md). The Windows target is dropped: the Ubuntu 14.04 VM has no Java, so the canary runs from a bundled JDK 8. - [x] **3b. Lab runs**: direct-to-Log4j baseline vs through LogShield, balanced and hardened profiles (see [lab.md](lab.md)). The egress-filter comparison was dropped: the oracle never sends traffic, and egress control is outside LogShield's scope. - [x] **3c. Differential validation**: label the corpus with ground truth from real vulnerable Log4j, compare against engine verdicts -- [ ] **3d. Release engineering**: distroless non-root image, keyless signing, SBOM, build provenance, CodeQL, Scorecard, branch protection. Pipeline, image, Scorecard and CodeQL are in place; branch protection and the first signed tag are the remaining items. +- [x] **3d. Release engineering**: distroless non-root image, keyless signing, SBOM, build provenance, CodeQL, Scorecard, branch protection. v0.1.0 is released: signed, attested, reproducible archives and a signed image, verified end to end (see [releasing.md](releasing.md)). `main` accepts pull requests only. - [x] **3e. Documentation**: threat model, limits, layered-defense argument, OT/ICS mapping, quickstart ## Step 4 (optional) diff --git a/docs/assurance.md b/docs/assurance.md index d0a5b5a..2d47989 100644 --- a/docs/assurance.md +++ b/docs/assurance.md @@ -9,11 +9,11 @@ certification. Where a practice is only partly met, it says so. | Check | Status | Evidence | |---|---|---| | Binary-Artifacts | Met | No binaries in the repository or its history | -| Branch-Protection | Met once the ruleset is applied | `scripts/repo-settings.sh --protect`: pull requests, passing checks, no force-push, no deletion (applied before the first stable release) | +| Branch-Protection | Met | Ruleset on `main`: pull requests, six required passing checks, up-to-date branches, linear history, no force-push, no deletion (`scripts/repo-settings.sh --protect` recreates it) | | CI-Tests | Met | [ci.yml](../.github/workflows/ci.yml): unit, race, fuzz smoke, integration, load smoke, three operating systems | | CII-Best-Practices | Met | "Passing" badge: | | Maintained | Time-based | Scorecard requires the repository to be at least 90 days old; commits are frequent | -| Code-Review | Limited | Single maintainer today; once the ruleset is applied every change is a pull request with passing CI, but human review depends on contributors | +| Code-Review | Limited | Single maintainer today; every change is a pull request with passing CI, but human review depends on contributors | | Dangerous-Workflow | Met | No `pull_request_target`, no untrusted input in `run` steps | | Dependency-Update-Tool | Met | [Dependabot](../.github/dependabot.yml) for Go modules, Actions and Docker | | Fuzzing | Met | Go fuzz targets run on every change and weekly |