Supply Chain Security Initiative

[lfrancke]

We'd like to take on various projects to strengthen our security posture and make our (and our customer's) supply chain secure.

There are some related tasks in here that are not strictly about security

Do

Beta Give feedback

1. Create and publish Software Bill of Materials (SBOMs) for our operators, products and docker images #168
   7 of 7
   epic type/feature-new +2
   
2. Add Lifecycle information to our Stackable DB for SDP releases #496
   demo-needed +1
   
3. Vulnerability scanning and reporting #423
   0 of 1
   +0
   
4. https://github.com/stackabletech/infrastructure/issues/145
5. https://github.com/stackabletech/infrastructure/issues/149
6. Document origins and versions of additional scripts / exporters docker-images#44
   +0
7. Licenses for 3rd party binaries docker-images#550
   +0
8. https://github.com/stackabletech/infrastructure/issues/155
9. Remove unnecessary dependencies from our images docker-images#627
   +0
10. Improve SBOMs #580
    0 of 2
    +0
11. Vulnerability Management #583
    8 of 18
    +0
    

Done

Beta Give feedback

1. https://github.com/stackabletech/infrastructure/issues/115
2. Signed Commits #400
   8 of 8
   +0
   
3. Publishing Helm charts in an OCI compatible repository #381
   customer-request +1
   
4. Signing images & publishing signatures #370
   7 of 7
   customer-request epic +2
   
5. Enable cargo-auditable for all our builds
6. Signing Helm charts

Maybe (Ideas / Scratchpad / Investigate)

Beta Give feedback

1. Evaluate CIS benchmark and adapt our Images if needed #408
   0 of 4
   +0
2. Scan our artifacts against security vulnerabilities at build time and regularly thereafter (e.g. Dependencytrack)
3. Update our base images regularly and rebuild product images
4. Publish signature hashes for releases on our homepage/in the release notes
5. Evaluate how/if we can get notified on changes to the git history
6. Evaluate whether we want to rename docker.stackable.tech to hub.stackable.tech or similar
7. Make sure that Stackable mirrors all external sources that we depend on in our development process #347
   +0
8. Look at Github Security Scanning / Dependabot etc.
9. Reproducible Builds
10. SLSA Level
11. Use FSFE REUSE
12. OpenSSF Badge: https://bestpractices.coreinfrastructure.org/en/projects/7197
13. in-toto Attestations for Security scans, builds etc
14. See if we can ingest https://www.first.org/epss/data_stats and display that / use for prioritization
15. SBOM Quality control #422
    0 of 4
    epic +1
16. Add EoL information as an annotation to each Pod
17. Add some GUAC and TACOS to our SLSA: https://github.com/tacosframework / https://github.com/guacsec/guac
18. https://github.com/stackabletech/infrastructure/issues/143
19. https://github.com/stackabletech/infrastructure/issues/142
20. Overhaul Nexus package management #515
    +0
21. https://reproducible-builds.org/

See also https://app.nuclino.com/Stackable/Stackable/Supply-Chain-Security-ce7f8653-fc4b-4b8f-934f-d1ba6772e308 (internal only)

Vulnerability Management

Beta Give feedback

1. ISO 29147
2. ISO 30111

Interesting Links

Beta Give feedback

1. https://securityscorecards.dev/
2. https://github.com/marketplace/actions/openssf-scorecard-monitor
3. https://slsa.dev/ & https://github.com/slsa-framework/slsa-github-generator
4. https://www.docker.com/blog/capturing-build-information-buildkit/
5. https://www.openchainproject.org/
6. https://www.iso.org/standard/81039.html
7. https://www.iso.org/standard/86450.html
8. https://best.openssf.org/SCM-BestPractices/
9. https://openeox.org/
10. https://owasp.org/www-project-kubernetes-top-ten/
11. https://github.com/kubescape/kubescape
12. https://drive.google.com/file/d/14SrYl1HyfjVUTnj5uu2vjrmv5YcOjXLP/view
13. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
14. https://github.com/xeol-io/xeol
15. https://github.com/google/clusterfuzz / https://github.com/google/clusterfuzzlite
16. https://github.com/oracle/macaron
17. https://openssf.org/blog/2023/10/11/openssf-introduces-the-specification-security-insights-1-0/
18. https://docs.github.com/en/code-security/security-advisories/working-with-repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository
19. https://github.com/gittuf/gittuf
20. https://www.cvedetails.com/
21. https://mvsp.dev/
22. https://www.thorsten-hans.com/read-only-filesystems-in-docker-and-kubernetes/
23. https://docs.github.com/en/communities/setting-up-your-project-for-healthy-contributions/creating-a-default-community-health-file
24. https://media.defense.gov/2022/Aug/29/2003066362/-1/-1/0/CTR_KUBERNETES_HARDENING_GUIDANCE_1.2_20220829.PDF
25. https://github.com/github/issue-metrics
26. https://github.com/stacklok/minder
27. https://gcore.com/docs/dns/dns-records/what-is-an-https-record-and-how-is-it-configured

[soenkeliebau]

Meeting on friday (29.9.2023) about the current state of implementation, afterwards we'll probably have a bit more clarity on this and can refine it further.

[fhennig]

I found this ticket which I think should be linked here: stackabletech/docker-images#44 (or maybe just close it, linking to a different one)