Skip to content

Commit 3948ad5

Browse files
adityasakyadityasaky
authored
Add incubation proposal for gittuf (#486)
* Add incubation proposal for gittuf * Fix path of gittuf's incubation application --------- Signed-off-by: Aditya Sirish <aditya@saky.in>
1 parent f827b7b commit 3948ad5

File tree

2 files changed

+146
-1
lines changed

2 files changed

+146
-1
lines changed

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ The following Technical Initiatives have been approved by the TAC. You may learn
7272
| Criticality Score | [GitHub](https://github.com/ossf/criticality_score) | | Securing Critical Projects WG | TBD |
7373
| Fuzz Introspector | [GitHub](https://github.com/ossf/fuzz-introspector) | | Security Tooling WG | TBD |
7474
| GUAC | [GitHub](https://github.com/guacsec/guac) | https://guac.sh | Supply Chain Integrity WG | [Incubating](process/project-lifecycle-documents/guac_incubating.md) |
75-
| gittuf | [GitHub](https://github.com/gittuf/gittuf) | https://gittuf.dev/ | Supply Chain Integrity WG | [Sandbox](process/project-lifecycle-documents/gittuf_sandbox_stage.md) |
75+
| gittuf | [GitHub](https://github.com/gittuf/gittuf) | https://gittuf.dev/ | Supply Chain Integrity WG | [Incubating](process/project-lifecycle-documents/gittuf_incubating_stage.md) |
7676
| OpenSSF Scorecard | [GitHub](https://github.com/ossf/scorecard) | https://securityscorecards.dev/ | Best Practices WG | [Incubating](/process/project-lifecycle-documents/openssf_scorecard_incubating_stage.md) |
7777
| OpenVEX | [GitHub](https://github.com/openvex) | | Vulnerability Disclosures WG | [Sandbox](process/project-lifecycle-documents/openvex_for_sandbox_stage.md) |
7878
| OSV Schema | [GitHub](https://github.com/ossf/osv-schema) | https://ossf.github.io/osv-schema/ | Vulnerability Disclosures WG | TBD |

‎process/project-lifecycle-documents/gittuf_incubating_stage.md

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
# gittuf incubation application
2+
3+
## Project has met all Sandbox requirement
4+
5+
* Sandbox PR: https://github.com/ossf/tac/pull/198
6+
* Sandbox Licensing and DD PR: https://github.com/ossf/tac/pull/199
7+
* Sandbox Document: https://github.com/ossf/tac/blob/main/process/project-lifecycle-documents/gittuf_sandbox_stage.md
8+
9+
## List of project maintainers
10+
11+
The project must have a minimum of three maintainers with a minimum of two different organizational affiliations.
12+
* Aditya Sirish A Yelgundhalli, New York University / Bloomberg, adityasaky
13+
* Billy Lynch, Chainguard, wlynch
14+
* Patrick Zielinski, New York University, patzielinski
15+
* Reza Curtmola, New Jersey Institute of Technology, reza-curtmola
16+
* Justin Cappos, New York University, JustinCappos
17+
* Neil Naveen, Independent, neilnaveen
18+
19+
## Mission of the project
20+
21+
Source code is typically stored in a version control system, of which the most
22+
popular is Git. To prevent software supply chain attacks that tamper with source
23+
code, it's common to use access control policies (e.g., the developers trusted
24+
to make changes to a branch in the repository, the number of review approvals
25+
required for changes). Such policies are typically enforced by _source control
26+
platforms_ (SCP). However, these platforms become a single point of trust; a
27+
compromised SCP can undermine the security controls configured for the
28+
repository. gittuf's mission is to make Git security policies _independently
29+
verifiable / enforceable_, thereby removing the SCP as a fully trusted entity in
30+
the supply chain.
31+
32+
## Project adoption
33+
34+
gittuf has recently reached a beta release. We've been collaborating with
35+
industry and open source projects to run gittuf pilots to improve the system's
36+
guarantees and user experience.
37+
38+
### Bloomberg
39+
40+
Bloomberg is currently running a pilot of gittuf.
41+
42+
> Dennis Roellke, a security architect at Bloomberg, is leading a Gittuf pilot
43+
project in various departments of the financial news and information company.
44+
His primary job responsibility is to ensure the integrity of the software supply
45+
chain throughout different groups.
46+
>
47+
> [...]
48+
>
49+
> Roellke said his team is continuing to scale up its Gittuf interfaces for use
50+
by larger and more varied teams of engineers inside Bloomberg.
51+
52+
Source: https://news.njit.edu/cybersecurity-researcher-njit-toughens-git-software-repositories
53+
54+
### Open Source Projects
55+
56+
Other projects in the software supply chain security space have begun piloting
57+
gittuf.
58+
59+
#### GUAC
60+
61+
The GUAC project, incubated at the OpenSSF, has started using gittuf via the
62+
GitHub app on their [documentation
63+
repository](https://github.com/guacsec/guac-docs) to record pull request
64+
approval and merge attestations. Example:
65+
https://github.com/guacsec/guac-docs/pull/203#issuecomment-2898386819
66+
67+
#### in-toto
68+
69+
The in-toto project, a graduated project at the CNCF, has been dogfooding gittuf
70+
in the [attestation-verifier
71+
repository](https://github.com/in-toto/attestation-verifier) for a year. The
72+
project recently switched over to using the gittuf GitHub app. Example:
73+
https://github.com/in-toto/attestation-verifier/pull/77#issuecomment-2901762106
74+
75+
#### Chainsights
76+
77+
Kusari's open source [chainsights](https://github.com/kusari-oss/chainsights)
78+
repository is part of the gittuf GitHub app pilot.
79+
80+
#### SLSA
81+
82+
gittuf is closely aligned with the upcoming SLSA source track. Work is underway
83+
to allow gittuf to be used to achieve SLSA source level 3. The draft SLSA source
84+
track specification lists gittuf as a way to enforce change management process.
85+
86+
> Enforcement of the organization-defined technical controls could be
87+
accomplished by, for example:
88+
> - The configuration of branch protection rules (e.g.GitHub, GitLab) which
89+
> require additional checks to ‘pass’ (e.g. unit tests, linters), or
90+
> - the application and verification of gittuf policies, or
91+
> - some other mechanism as enforced by the Change management tool.
92+
93+
Source: https://slsa.dev/spec/draft/source-requirements
94+
95+
## Governance
96+
97+
Project must have met publicly at least 5 times in the last quarter since becoming Sandbox
98+
* [2025 Notes](https://docs.google.com/document/d/1EbFAZu_pxayLwr4QWxhKCSZYhyJAcya7K-b_kuXlmpU/edit?tab=t.0)
99+
* [2024 Notes](https://docs.google.com/document/d/1tXFCVUHsICLpLKxcGvhzBDUWmpsY1LQvysFaX6AJRkk/edit?tab=t.0)
100+
101+
Projects must have documented, initial project governance
102+
* https://github.com/gittuf/community/blob/main/CHARTER.md
103+
104+
Project must have defined Contributor Guide
105+
* https://github.com/gittuf/gittuf/blob/main/CONTRIBUTING.md
106+
107+
Project has attained an OpenSSF Best Practice Badge at "passing" level
108+
* https://www.bestpractices.dev/en/projects/7789
109+
110+
Project is integrated into the OpenSSF Scorecard
111+
* https://scorecard.dev/viewer/?uri=github.com%2Fgittuf%2Fgittuf
112+
113+
## IP policy and licensing due diligence
114+
115+
Not applicable now, completed when entering OpenSSF sandbox, tracked in
116+
https://github.com/ossf/tac/issues/199.
117+
118+
The gittuf implementation is licensed under Apache 2.0. Source:
119+
https://github.com/gittuf/gittuf/blob/main/LICENSE
120+
121+
## Security Baseline
122+
123+
The project meets all applicable Security Baseline requirements:
124+
* [x] [Security Baseline - Once Sandbox](https://github.com/ossf/tac/blob/main/process/security_baseline.md#security-baseline---once-sandbox)
125+
* [x] [Security Baseline - To Become Incubating](https://github.com/ossf/tac/blob/main/process/security_baseline.md#security-baseline---to-become-incubating)
126+
127+
## Project References
128+
129+
The project should provide a list of existing resources with links to the repository, website, a roadmap, contributing guide, demos and walkthroughs, and any other material to showcase the existing breadth, maturity, and direction of the project.
130+
131+
| Reference | URL |
132+
|-----------------------|-----|
133+
| Repo | https://github.com/gittuf/gittuf |
134+
| Meeting Agenda | https://docs.google.com/document/d/1EbFAZu_pxayLwr4QWxhKCSZYhyJAcya7K-b_kuXlmpU/edit?tab=t.0 |
135+
| OSSF Calendar Entry | https://openssf.org/getinvolved/ |
136+
| Website | https://gittuf.dev |
137+
| Contributing guide | https://github.com/gittuf/gittuf/blob/main/CONTRIBUTING.md |
138+
| Security.md | https://github.com/gittuf/gittuf/blob/main/SECURITY.md |
139+
| Roadmap | https://github.com/gittuf/gittuf/blob/main/docs/roadmap.md |
140+
| Demos | https://github.com/gittuf/demo |
141+
| Best Practices Badge | https://www.bestpractices.dev/en/projects/7789 |
142+
| Scorecard integration | https://scorecard.dev/viewer/?uri=github.com%2Fgittuf%2Fgittuf |
143+
| Talks | https://www.youtube.com/watch?v=eCSeIEdMbCw&pp=ygUGZ2l0dHVm, https://www.youtube.com/watch?v=5bWpeZNK00Q&pp=ygUGZ2l0dHVm |
144+
| Misc. Coverage | https://lwn.net/Articles/972467/ |
145+
| Research Paper | https://www.ndss-symposium.org/ndss-paper/rethinking-trust-in-forge-based-git-security/ |

0 commit comments

Comments
 (0)