Repository navigation
Expand file tree
/
Copy path.bestpractices.json
More file actions
136 lines (136 loc) · 9.44 KB
/
Copy path.bestpractices.json
File metadata and controls
136 lines (136 loc) · 9.44 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
{
"description_good_status": "Met",
"description_good_justification": "README.md now opens with a concise project description and a consistent accessible header.",
"interact_status": "Met",
"interact_justification": "The README and GitHub repository provide project information and an issue channel.",
"contribution_status": "Unmet",
"contribution_justification": "No CONTRIBUTING file was found in the repository tree.",
"contribution_requirements_status": "Unmet",
"contribution_requirements_justification": "Contribution requirements are not documented in a CONTRIBUTING file.",
"floss_license_status": "Unmet",
"floss_license_justification": "No root or project license file was detected.",
"floss_license_osi_status": "?",
"floss_license_osi_justification": "The license could not be identified automatically as OSI-approved.",
"license_location_status": "Unmet",
"license_location_justification": "No tracked license file was detected.",
"documentation_basics_status": "Met",
"documentation_basics_justification": "README documentation is tracked and receives the shared repository header and badge convention.",
"documentation_interface_status": "?",
"documentation_interface_justification": "Interface documentation varies by project and requires project-specific review beyond the repository-wide audit.",
"sites_https_status": "Met",
"sites_https_justification": "The project repository is delivered over HTTPS at https://github.com/dcondrey/dcondrey.",
"discussion_status": "Met",
"discussion_justification": "GitHub Issues provides a URL-addressable discussion channel.",
"english_status": "Met",
"english_justification": "Repository documentation and automation examined by this audit are written in English.",
"maintained_status": "Met",
"maintained_justification": "Repository activity is within the last two years.",
"repo_public_status": "Met",
"repo_public_justification": "The source repository is publicly readable at https://github.com/dcondrey/dcondrey.",
"repo_track_status": "Met",
"repo_track_justification": "Git tracks authorship, timestamps, commit messages, and diffs.",
"repo_interim_status": "Met",
"repo_interim_justification": "Git supports incremental, reviewable project history.",
"repo_distributed_status": "Met",
"repo_distributed_justification": "The project uses Git, a distributed version-control system.",
"version_unique_status": "?",
"version_unique_justification": "Version declaration and uniqueness require package-specific review.",
"version_semver_status": "?",
"version_semver_justification": "Version-number semantics require package-specific review.",
"version_tags_status": "Unmet",
"version_tags_justification": "No repository tags were found.",
"release_notes_status": "N/A",
"release_notes_justification": "No tagged release exists to evaluate.",
"release_notes_vulns_status": "N/A",
"release_notes_vulns_justification": "No tagged release exists to evaluate.",
"report_process_status": "?",
"report_process_justification": "GitHub Issues is enabled, but structured reporting instructions were not detected.",
"report_tracker_status": "Met",
"report_tracker_justification": "GitHub Issues provides a per-item tracker.",
"report_responses_status": "?",
"report_responses_justification": "Response-time performance requires historical issue review.",
"enhancement_responses_status": "?",
"enhancement_responses_justification": "Enhancement response-time performance requires historical issue review.",
"report_archive_status": "Met",
"report_archive_justification": "GitHub Issues provides a public searchable archive.",
"vulnerability_report_process_status": "Unmet",
"vulnerability_report_process_justification": "No SECURITY policy file was detected.",
"vulnerability_report_private_status": "?",
"vulnerability_report_private_justification": "A private vulnerability-reporting route was not established from repository files.",
"vulnerability_report_response_status": "?",
"vulnerability_report_response_justification": "Vulnerability response performance requires historical report review.",
"build_status": "?",
"build_justification": "No recognized build manifest was detected; manual review is required.",
"build_common_tools_status": "?",
"build_common_tools_justification": "Build tooling was not identified automatically.",
"build_floss_tools_status": "?",
"build_floss_tools_justification": "Build-tool licensing requires dependency-level review.",
"test_status": "Unmet",
"test_justification": "No conventional test directory was detected.",
"test_invocation_status": "Unmet",
"test_invocation_justification": "No automated test invocation was detected.",
"test_most_status": "?",
"test_most_justification": "Coverage breadth and thresholds require coverage evidence.",
"test_continuous_integration_status": "Unmet",
"test_continuous_integration_justification": "No recognizable test command was found in GitHub Actions.",
"test_policy_status": "?",
"test_policy_justification": "A documented test-addition policy requires manual review.",
"tests_are_added_status": "?",
"tests_are_added_justification": "Test-addition history was not established.",
"tests_documented_added_status": "?",
"tests_documented_added_justification": "Documented expectations for adding tests were not established.",
"warnings_status": "Unmet",
"warnings_justification": "No lint or warning checker was detected in CI.",
"warnings_fixed_status": "?",
"warnings_fixed_justification": "Whether all warnings fail the build requires workflow-level policy review.",
"warnings_strict_status": "?",
"warnings_strict_justification": "Strict warning configuration requires language-specific review.",
"know_secure_design_status": "?",
"know_secure_design_justification": "Secure-design documentation was not identified automatically.",
"know_common_errors_status": "?",
"know_common_errors_justification": "Automated common-error detection was not identified.",
"crypto_published_status": "?",
"crypto_published_justification": "Project-specific review is required to determine cryptographic design publication and applicability.",
"crypto_call_status": "?",
"crypto_call_justification": "Project-specific review is required to determine cryptographic API design and applicability.",
"crypto_floss_status": "?",
"crypto_floss_justification": "Project-specific review is required to determine cryptographic implementation licensing and applicability.",
"crypto_keylength_status": "?",
"crypto_keylength_justification": "Project-specific review is required to determine cryptographic key-length selection and applicability.",
"crypto_working_status": "?",
"crypto_working_justification": "Project-specific review is required to determine cryptographic implementation validation and applicability.",
"crypto_weaknesses_status": "?",
"crypto_weaknesses_justification": "Project-specific review is required to determine cryptographic weakness review and applicability.",
"crypto_pfs_status": "?",
"crypto_pfs_justification": "Project-specific review is required to determine forward-secrecy requirements and applicability.",
"crypto_password_storage_status": "?",
"crypto_password_storage_justification": "Project-specific review is required to determine password-storage requirements and applicability.",
"crypto_random_status": "?",
"crypto_random_justification": "Project-specific review is required to determine cryptographic randomness requirements and applicability.",
"delivery_mitm_status": "Met",
"delivery_mitm_justification": "GitHub source delivery uses authenticated HTTPS or SSH transports.",
"delivery_unsigned_status": "Met",
"delivery_unsigned_justification": "No plain-HTTP software-delivery path was identified in this repository-level audit.",
"vulnerabilities_fixed_60_days_status": "?",
"vulnerabilities_fixed_60_days_justification": "Remediation timing requires historical vulnerability review.",
"vulnerabilities_critical_fixed_status": "?",
"vulnerabilities_critical_fixed_justification": "Critical-vulnerability remediation requires historical advisory review.",
"no_leaked_credentials_status": "?",
"no_leaked_credentials_justification": "Absence of leaked credentials cannot be proven from repository structure alone.",
"static_analysis_status": "Unmet",
"static_analysis_justification": "No recognizable static-analysis job was detected.",
"static_analysis_common_vulnerabilities_status": "Unmet",
"static_analysis_common_vulnerabilities_justification": "No static vulnerability analysis was detected.",
"static_analysis_fixed_status": "?",
"static_analysis_fixed_justification": "Finding-remediation policy requires workflow and history review.",
"static_analysis_often_status": "Unmet",
"static_analysis_often_justification": "Frequent automated static analysis was not detected.",
"dynamic_analysis_status": "Unmet",
"dynamic_analysis_justification": "No dedicated fuzzing or dynamic security-analysis job was detected.",
"dynamic_analysis_unsafe_status": "?",
"dynamic_analysis_unsafe_justification": "Memory-unsafe language use and dynamic-analysis applicability require project-specific review.",
"dynamic_analysis_enable_assertions_status": "?",
"dynamic_analysis_enable_assertions_justification": "Assertion configuration for dynamic-analysis builds requires project-specific review.",
"dynamic_analysis_fixed_status": "?",
"dynamic_analysis_fixed_justification": "Dynamic-analysis finding remediation requires historical review."
}