Trust¶
Every project here is made from one blueprint, which builds, signs and checks its releases, so they all give the same guarantees. You don't have to take them on trust: each guarantee below comes with a way to check it yourself. This page is about the projects; This website is about the security and privacy of the website itself.
| Guarantee | Autodarts | Paperless Sync | Paperless Unified Search | Issue assistant | Repo Blueprint |
|---|---|---|---|---|---|
| Latest release | GitHub | GitHub | GitHub | GitHub | GitHub |
| Signed tags | gitsign, without a key | gitsign, without a key | gitsign, without a key | gitsign, without a key | gitsign, without a key |
| Build provenance | SLSA Build Level 3 | SLSA Build Level 3 | SLSA Build Level 3 | SLSA Build Level 3 | SLSA Build Level 3 |
| Immutable releases | yes | yes | yes | yes | yes |
| SBOM | SPDX and CycloneDX | SPDX and CycloneDX | SPDX and CycloneDX | SPDX and CycloneDX | SPDX and CycloneDX |
| OpenVEX | for every accepted advisory | for every accepted advisory | for every accepted advisory | for every accepted advisory | for every accepted advisory |
| Test coverage | — | — | — | — | — |
| Mutation score | — | — | — | — | — |
| OpenSSF Scorecard | — | — | — | — | — |
| OpenSSF Best Practices | silver | silver | silver | silver | silver |
| Security policy | SECURITY.md | SECURITY.md | SECURITY.md | SECURITY.md | SECURITY.md |
| Report a vulnerability | privately | privately | privately | privately | privately |
The latest releases and the numbers of the tests and of the Scorecard come from the dashboard as the page loads, and follow it within two hours; a dash stands for a number that it doesn't have. The build reads the level of the OpenSSF Best Practices from bestpractices.dev every day.
What the guarantees mean¶
- Signed tags. The release workflow of each project signs the tag of every release with gitsign: with a certificate of Sigstore for that workflow, valid for ten minutes, instead of a key. No signing key exists that could leak, and the workflow builds no release on a tag that it didn't sign. GitHub shows these tags as Unverified, since it doesn't check certificates of Sigstore; gitsign does, as Check a signed tag shows.
- Build provenance. Every file of a release comes from an isolated build, whose workflow signs with Sigstore where and how it built the file, from which commit: its provenance, at SLSA Build Level 3.
- Immutable releases. Once a release is published, neither its files nor its tag can change. GitHub signs an attestation that ties the tag to its commit and to every file of the release.
- SBOM. Every release lists what it ships, with every component inside it, under its name and version, as SPDX and as CycloneDX, so that a scanner such as Grype checks it against the advisories that it knows.
THIRD_PARTY_NOTICES.mdbeside it has the licenses of the third-party components. - OpenVEX. When a project accepts an advisory, with the reason why it doesn't affect the project, its release carries an OpenVEX document that tells a scanner so. A release without an accepted advisory carries none.
- Checked as you can. After every release and every week, a workflow of each project verifies its latest release the way the commands below do.
- Test coverage and mutation score. The share of the code that the tests of a project run, and the share of mutants, small changes to the code, that its tests catch.
- OpenSSF Scorecard. The OpenSSF Scorecard rates the security practices of each repository every week, out of 10, such as signed releases, pinned dependencies, the protection of its main branch and the permissions of its workflows.
- OpenSSF Best Practices. The OpenSSF Best Practices badge of each project, at the level of passing, silver or gold, each of which asks for more criteria than the one before.
- Security policy and private reports. The SECURITY.md of each project says what happens with a report of a vulnerability: an answer within 7 days, a first assessment within 14 and a fixed release within 90 days at the latest. Reports go privately to the project, through the form of GitHub in the table, never into a public issue.
Check a release yourself¶
The GitHub CLI, gh, checks the signatures with the public keys of GitHub and Sigstore, which it fetches itself. Without a tag, it takes the latest release, which the table shows; these commands check releases made since the release workflow of a project builds immutable, signed releases, and older releases give the guarantees that the SECURITY.md of their project described at the time. The first command checks the attestation of the release and prints the files that it ties to its tag; the second downloads the package that you install, or the SBOM of a project without one; and the third checks the provenance of that file and prints Verification succeeded: the release workflow of the project built it from the commit of the tag.
gh release verify --repo Dennis-Otto/ha-autodarts
gh release download --repo Dennis-Otto/ha-autodarts --pattern autodarts.zip --clobber
gh attestation verify autodarts.zip --repo Dennis-Otto/ha-autodarts --signer-workflow Dennis-Otto/ha-autodarts/.github/workflows/build-release.yml
gh release verify --repo Dennis-Otto/paperless-sync
gh release download --repo Dennis-Otto/paperless-sync --pattern paperless_sync.tar.gz --clobber
gh attestation verify paperless_sync.tar.gz --repo Dennis-Otto/paperless-sync --signer-workflow Dennis-Otto/paperless-sync/.github/workflows/build-release.yml
gh release verify --repo Dennis-Otto/paperless-unified-search
gh release download --repo Dennis-Otto/paperless-unified-search --pattern paperless_unified_search.tar.gz --clobber
gh attestation verify paperless_unified_search.tar.gz --repo Dennis-Otto/paperless-unified-search --signer-workflow Dennis-Otto/paperless-unified-search/.github/workflows/build-release.yml
gh release verify --repo Dennis-Otto/issue-assistant
gh release download --repo Dennis-Otto/issue-assistant --pattern issue-assistant.spdx.json --clobber
gh attestation verify issue-assistant.spdx.json --repo Dennis-Otto/issue-assistant --signer-workflow Dennis-Otto/issue-assistant/.github/workflows/build-release.yml
gh release verify --repo Dennis-Otto/repo-blueprint
gh release download --repo Dennis-Otto/repo-blueprint --pattern repo-blueprint.spdx.json --clobber
gh attestation verify repo-blueprint.spdx.json --repo Dennis-Otto/repo-blueprint --signer-workflow Dennis-Otto/repo-blueprint/.github/workflows/build-release.yml
Check a signed tag¶
gitsign checks the signature of a tag as the workflow that verifies every release does: that the release workflow of the project signed it, on its main. In a shell such as Bash, with the name of the repository of a project in repo:
repo=ha-autodarts
git clone --quiet --no-checkout --filter=blob:none "https://github.com/Dennis-Otto/$repo.git"
cd "$repo"
tag=$(gh release view --repo "Dennis-Otto/$repo" --json tagName --jq .tagName)
gitsign verify-tag "$tag" --certificate-identity "https://github.com/Dennis-Otto/$repo/.github/workflows/release.yml@refs/heads/main" --certificate-oidc-issuer https://token.actions.githubusercontent.com
Report a vulnerability¶
Please don't open a public issue for a suspected vulnerability. Report it privately to its project, with the link in the table; This website says where a vulnerability of the website goes. The About page tells who builds the projects and how.