Skip to main content
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [List Home]
Re: [eclipse.org-architecture-council] RFC: Eclipse Foundation Secure Software Supply Chain Levels

I like the proposal.

 

Some comments regarding securing of source code repositories:

 

Commit signing:

  • important on git servers like GitHub and GitLab which have no means to prohibit forging of committer identities (supported in Gerrit).
  • still a can of worms, see e.g. https://lobi.to/writes/wacksigning/
  • I think most promising is gitsign leveraging Sigstore infrastructure and push signing, though GitHub and GitLab don’t support it (Gerrit does).

 

Authenticating to git servers using short lived OAuth tokens (not long-lived personal access tokens) is possible with

https://github.com/hickford/git-credential-oauth

 

I think we should encourage hardware keys for MFA, I started using yubikeys a couple of months ago and never looked back

 

I would welcome a policy that commits should use the real name of the contributor instead of an anonymous nick name which seems to be popular on GitHub.

 

From: eclipse.org-architecture-council <eclipse.org-architecture-council-bounces@xxxxxxxxxxx> on behalf of Mikael Barbero via eclipse.org-architecture-council <eclipse.org-architecture-council@xxxxxxxxxxx>
Date: Wednesday, 26. June 2024 at 22:28
To: eclipse.org-architecture-council <eclipse.org-architecture-council@xxxxxxxxxxx>
Cc: Mikael Barbero <mikael.barbero@xxxxxxxxxxxxxxxxxxxxxx>
Subject: [eclipse.org-architecture-council] RFC: Eclipse Foundation Secure Software Supply Chain Levels

Dear Architecture Council members,

 

This is a request for review and feedback on a new security framework proposal, Eclipse Foundation Secure Supply Chain Lifecycle (EF3SCL). EF3SCL is a pragmatic security framework designed to promote actionable security practices and provide a clear progression path for Eclipse Foundation projects to secure their supply chains.

 

The draft document for EF3SCL can be found here: https://github.com/eclipse-csi/gradually/blob/main/EF3SCL.md 

 

We have shared this framework with several other groups. To gather all feedback and allow for inter-group discussion, we have initiated a discussion thread on GitHub. In this thread, we provide context and reasoning behind the creation of this framework. We would greatly appreciate it if you could share your comments there.

 

We look forward to your valuable feedback and guidance.

 

Cheers,


Mikaël Barbero 

Head of Security | Eclipse Foundation

Eclipse Foundation: The Community for Open Innovation and Collaboration

 

Back to the top