Skip to content

Record v0.1.0 and branch protection in the roadmap and assurance docs #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
TurlaFSB merged 1 commit into from
Oct 17, 2026
Merged

Record v0.1.0 and branch protection in the roadmap and assurance docs #6

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/ROADMAP.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ These are goals to be confirmed by measurement, not claims.
- [x] **3a. Lab design and tooling**: a Log4j 2.14.1 canary with a hermetic JNDI hook, a logging-only listener, the `labrun` differential runner, a verified host-side bundle, and [docs/lab.md](lab.md). The Windows target is dropped: the Ubuntu 14.04 VM has no Java, so the canary runs from a bundled JDK 8.
- [x] **3b. Lab runs**: direct-to-Log4j baseline vs through LogShield, balanced and hardened profiles (see [lab.md](lab.md)). The egress-filter comparison was dropped: the oracle never sends traffic, and egress control is outside LogShield's scope.
- [x] **3c. Differential validation**: label the corpus with ground truth from real vulnerable Log4j, compare against engine verdicts
- [ ] **3d. Release engineering**: distroless non-root image, keyless signing, SBOM, build provenance, CodeQL, Scorecard, branch protection. Pipeline, image, Scorecard and CodeQL are in place; branch protection and the first signed tag are the remaining items.
- [x] **3d. Release engineering**: distroless non-root image, keyless signing, SBOM, build provenance, CodeQL, Scorecard, branch protection. v0.1.0 is released: signed, attested, reproducible archives and a signed image, verified end to end (see [releasing.md](releasing.md)). `main` accepts pull requests only.
- [x] **3e. Documentation**: threat model, limits, layered-defense argument, OT/ICS mapping, quickstart

## Step 4 (optional)
Expand Down
4 changes: 2 additions & 2 deletions docs/assurance.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,11 +9,11 @@ certification. Where a practice is only partly met, it says so.
| Check | Status | Evidence |
|---|---|---|
| Binary-Artifacts | Met | No binaries in the repository or its history |
| Branch-Protection | Met once the ruleset is applied | `scripts/repo-settings.sh --protect`: pull requests, passing checks, no force-push, no deletion (applied before the first stable release) |
| Branch-Protection | Met | Ruleset on `main`: pull requests, six required passing checks, up-to-date branches, linear history, no force-push, no deletion (`scripts/repo-settings.sh --protect` recreates it) |
| CI-Tests | Met | [ci.yml](../.github/workflows/ci.yml): unit, race, fuzz smoke, integration, load smoke, three operating systems |
| CII-Best-Practices | Met | "Passing" badge: <https://www.bestpractices.dev/projects/15621> |
| Maintained | Time-based | Scorecard requires the repository to be at least 90 days old; commits are frequent |
| Code-Review | Limited | Single maintainer today; once the ruleset is applied every change is a pull request with passing CI, but human review depends on contributors |
| Code-Review | Limited | Single maintainer today; every change is a pull request with passing CI, but human review depends on contributors |
| Dangerous-Workflow | Met | No `pull_request_target`, no untrusted input in `run` steps |
| Dependency-Update-Tool | Met | [Dependabot](../.github/dependabot.yml) for Go modules, Actions and Docker |
| Fuzzing | Met | Go fuzz targets run on every change and weekly |
Expand Down
Loading