trust: security policy, support window, private vulnerability reporting, Dependabot, signed checksums + provenance + SBOM on every release - #52
Merged
Conversation
…rting, Dependabot, and a release job that signs SHA256SUMS, attests provenance and attaches an SBOM SECURITY.md (and its docs copy under community/) states which versions get fixes, how to report privately, the response targets, and how to verify a download: SHA256SUMS on every release, plus from the next release a detached GPG signature by the release key, a GitHub build-provenance attestation per asset and an SPDX SBOM of the source tree. The release workflow gains a `trust` job that produces those after every build; `finish` requires it. Dependabot watches the six manifests. README, the docs index, the FAQ, contributing and the three install pages link to it; the roadmap records it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YG6wFApZpg2xe61EmKhaSZ
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The trust artefacts a platform or security review reads first.
SECURITY.md(anddocs/community/security.mdfor the site): supported versions and the support window (current minor gets patch releases on every registry at once), private vulnerability reporting as the only channel (enabled on the repository today), acknowledgement within three business days and a thirty-day fix target, scope (bridge and bindings in; third-party drivers and servers out, recorded inUPSTREAM.md), and Verifying a download.trustjob after every build: downloads the release's assets, writesSHA256SUMS, signs it with the release key (same key as Maven Central,95CC478E1985A908), generates an SPDX SBOM of the source tree withanchore/sbom-action, records a build-provenance attestation for every asset withactions/attest-build-provenance(sogh attestation verify <file> --repo singhpratech/adbcbridgeworks), and attaches the three files.finishnow requires it.SHA256SUMS(attached today); its signature follows once signed offline..github/dependabot.yml: weekly updates for Actions, pip, cargo, nuget, maven and gomod.🤖 Generated with Claude Code
https://claude.ai/code/session_01YG6wFApZpg2xe61EmKhaSZ