Repository navigation
Releases
Releases · Obaaf/OBAAF
OBAAF 0.3.0
OBAAF 0.3.0
Upgrading from 0.2.0: a gate that passed can fail without the workflows having
changed. Several changes make the checker report what it missed before.
Checker
- A job now gets the rules of every lane it belongs to. A job that runs an agent
and publishes was checked for one of the two; it is now checked for both. A lane
declaration adds rules and never removes a finding, and one that does nothing is
listed in the report's notes. - Secrets and outsider-written fields are read from an expression's tokens, not
matched as text. secrets.*, a computed secret name and several spellings that got
past OBAAF-GHA-010 are now reported. A file the checker cannot read is an error. - New rule OBAAF-GHA-024: a secret listed under protected_secrets may only be used
by jobs in the environment named for it. - Baselines: --write-baseline records today's findings and --baseline fails only on
new ones, or on entries that no longer match. - obaaf check .github/workflows no longer checks zero files and passes.
Jenkins (advisory)
- obaaf check reads Jenkinsfiles alongside workflows, with fifteen advisory rules,
OBAAF-JEN-001 to 015. Controller settings and shared-library code are reported as
unknown, never as a pass.
OBAAF's own supply chain
- The PyPI release now runs obaaf verify release before upload: provenance, build
record, environment approval by someone other than whoever created the tag, and
agent history.
Check a download yourself:
gh attestation verify obaaf-0.3.0-py3-none-any.whl --repo Obaaf/OBAAF
Project
- Governance is adopted and outside contributions are accepted under CONTRIBUTING.md.
- New documents: docs/landscape.md compares OBAAF with other tools, and
docs/egress-control.md is the design of an egress control for agent jobs.
Full changelog: CHANGELOG.md
OBAAF 0.2.0
OBAAF 0.2.0
Breaking
- Signed record types now use addresses under https://www.obaaf.com/attestation/
instead of the obaaf.example placeholder. Each address opens a page describing the
format. Records signed with 0.1 templates do not verify under 0.2.
Checker, from the first pilot's feedback (issue #19)
- Findings are split into authority (what an attacker could make the pipeline do) and
hygiene, and --fail-on authority:medium fails CI on authority findings only. - Agents launched through repository shell scripts are detected.
- Unpinned actions in ordinary read-only jobs are rated low; agent, release and effect
jobs stay high. - Runners chosen at run time between hosted and self-hosted machines are informational.
- Findings that need the lane architecture rather than a one-line fix are flagged.
OBAAF's own supply chain
- Dependencies install by exact version and SHA-256 hash.
- The setup action picks a Python 3.10 or later interpreter and is tested on Linux,
macOS and Windows. - Every release file carries signed build provenance, checked before upload.
Check a download yourself:
gh attestation verify obaaf-0.2.0-py3-none-any.whl --repo Obaaf/OBAAF
Papers
Full changelog: CHANGELOG.md