evaluation_plans

package
v0.32.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 13, 2026 License: Apache-2.0 Imports: 11 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	// OSPS contains assessment step implementations for OSPS Baseline controls.
	// Each catalog YAML defines which IDs are active for that version,
	// so the SDK only runs the relevant subset.
	OSPS = map[string][]TypedStep{
		"OSPS-AC-01.01": {
			reusable_steps.GithubBuiltIn,
		},
		"OSPS-AC-02.01": {
			reusable_steps.GithubBuiltIn,
		},
		"OSPS-AC-03.01": {
			access_control.BranchProtectionRestrictsPushes,
		},
		"OSPS-AC-03.02": {
			access_control.BranchProtectionPreventsDeletion,
		},
		"OSPS-AC-04.01": {
			access_control.WorkflowDefaultReadPermissions,
		},
		"OSPS-AC-04.02": {
			access_control.WorkflowJobPermissionsLeastPrivilege,
		},
		"OSPS-BR-01.01": {
			build_release.CicdSanitizedInputParameters,
		},
		"OSPS-BR-01.02": {

			reusable_steps.Retired,
		},
		"OSPS-BR-01.03": {
			build_release.CicdUntrustedCodeIsolation,
		},
		"OSPS-BR-01.04": {
			build_release.CicdSanitizesCollaboratorInput,
		},
		"OSPS-BR-02.01": {
			build_release.ReleaseHasUniqueIdentifier,
		},
		"OSPS-BR-02.02": {
			build_release.ReleaseAssetsAssociatedWithRelease,
		},
		"OSPS-BR-03.01": {
			build_release.EnsureInsightsLinksUseHTTPS,
		},
		"OSPS-BR-03.02": {
			build_release.DistributionPointsUseHTTPS,
		},
		"OSPS-BR-04.01": {
			build_release.EnsureLatestReleaseHasChangelog,
		},
		"OSPS-BR-05.01": {
			build_release.DependenciesUseStandardizedTooling,
		},
		"OSPS-BR-06.01": {
			reusable_steps.HasSecurityInsightsFile,
			build_release.ReleasesAreSignedOrAttested,
		},
		"OSPS-BR-07.01": {
			build_release.SecretScanningInUse,
		},
		"OSPS-BR-07.02": {
			build_release.SecretsManagementPolicy,
		},
		"OSPS-DO-01.01": {
			reusable_steps.HasSecurityInsightsFile,
			docs.HasUserGuides,
		},
		"OSPS-DO-02.01": {
			reusable_steps.HasIssuesOrDiscussionsEnabled,
			docs.AcceptsVulnReports,
		},
		"OSPS-DO-03.01": {
			reusable_steps.HasSecurityInsightsFile,
			docs.HasSignatureVerificationGuide,
		},
		"OSPS-DO-03.02": {
			reusable_steps.HasSecurityInsightsFile,
			docs.HasIdentityVerificationGuide,
		},
		"OSPS-DO-04.01": {
			docs.HasSupportDocs,
		},
		"OSPS-DO-05.01": {
			docs.DocumentsSecurityUpdatePolicy,
		},
		"OSPS-DO-06.01": {
			reusable_steps.IsCodeRepo,
			docs.HasDependencyManagementPolicy,
		},
		"OSPS-DO-07.01": {
			reusable_steps.IsCodeRepo,
			docs.HasBuildInstructions,
		},
		"OSPS-GV-01.01": {
			reusable_steps.IsActive,
			governance.CoreTeamIsListed,
			governance.ProjectAdminsListed,
		},
		"OSPS-GV-01.02": {
			governance.HasRolesAndResponsibilities,
		},
		"OSPS-GV-02.01": {
			reusable_steps.HasIssuesOrDiscussionsEnabled,
		},
		"OSPS-GV-03.01": {
			governance.HasContributionGuide,
		},
		"OSPS-GV-03.02": {
			reusable_steps.IsCodeRepo,
			reusable_steps.HasSecurityInsightsFile,
			reusable_steps.IsActive,
			governance.HasContributionReviewPolicy,
		},
		"OSPS-GV-04.01": {
			governance.HasEscalatedPermissionsReviewPolicy,
		},
		"OSPS-LE-01.01": {
			reusable_steps.GithubTermsOfService,
		},
		"OSPS-LE-02.01": {
			legal.FoundLicense,
			legal.GoodLicense,
		},
		"OSPS-LE-02.02": {
			legal.ReleasesLicensed,
			legal.GoodLicense,
		},
		"OSPS-LE-03.01": {
			legal.FoundLicense,
		},
		"OSPS-LE-03.02": {
			legal.ReleasesLicensed,
		},
		"OSPS-QA-01.01": {
			quality.RepoIsPublic,
		},
		"OSPS-QA-01.02": {
			reusable_steps.GithubBuiltIn,
		},
		"OSPS-QA-02.01": {
			quality.VerifyDependencyManagement,
		},
		"OSPS-QA-02.02": {
			quality.ReleasesHaveSBOM,
		},
		"OSPS-QA-03.01": {
			quality.StatusChecksAreRequiredByRulesets,
			quality.StatusChecksAreRequiredByBranchProtection,
		},
		"OSPS-QA-04.01": {
			reusable_steps.IsCodeRepo,
			reusable_steps.HasSecurityInsightsFile,
			reusable_steps.IsActive,
			quality.InsightsListsRepositories,
		},
		"OSPS-QA-04.02": {
			reusable_steps.IsCodeRepo,
			quality.SubprojectsEnforceSecurityRequirements,
		},
		"OSPS-QA-05.01": {
			quality.NoBinariesInRepo,
		},
		"OSPS-QA-05.02": {
			quality.NoUnreviewableBinariesInRepo,
		},
		"OSPS-QA-06.01": {
			reusable_steps.IsCodeRepo,
			quality.HasOneOrMoreStatusChecks,
		},
		"OSPS-QA-06.02": {
			quality.TestExecutionDocumentation,
		},
		"OSPS-QA-06.03": {
			reusable_steps.IsCodeRepo,
			quality.DocumentsTestMaintenancePolicy,
		},
		"OSPS-QA-07.01": {
			quality.RequiresNonAuthorApproval,
		},
		"OSPS-SA-01.01": {
			sec_assessment.HasDesignDocumentation,
		},
		"OSPS-SA-02.01": {
			sec_assessment.HasExternalInterfaceDocumentation,
		},
		"OSPS-SA-03.01": {
			sec_assessment.HasSecurityAssessment,
		},
		"OSPS-SA-03.02": {
			sec_assessment.HasThreatModelAnalysis,
		},
		"OSPS-VM-01.01": {
			reusable_steps.IsActive,
			vuln_management.HasVulnerabilityDisclosurePolicy,
		},
		"OSPS-VM-02.01": {
			reusable_steps.IsCodeRepo,
			vuln_management.HasSecContact,
		},
		"OSPS-VM-03.01": {
			reusable_steps.IsActive,
			vuln_management.HasPrivateVulnerabilityReporting,
		},
		"OSPS-VM-04.01": {
			reusable_steps.IsActive,
			vuln_management.PublishesVulnerabilityData,
		},
		"OSPS-VM-04.02": {
			reusable_steps.IsActive,
			vuln_management.HasVexDocument,
		},
		"OSPS-VM-05.01": {
			reusable_steps.IsActive,
			vuln_management.HasSCARemediationThresholdPolicy,
		},
		"OSPS-VM-05.03": {
			reusable_steps.IsActive,
			vuln_management.EnforcesSCAOnChanges,
		},
		"OSPS-VM-05.02": {
			reusable_steps.IsActive,
			vuln_management.HasSCAReleasePolicy,
		},
		"OSPS-VM-06.01": {
			reusable_steps.IsCodeRepo,
			vuln_management.HasSASTRemediationThresholdPolicy,
		},
		"OSPS-VM-06.02": {
			reusable_steps.IsCodeRepo,
			vuln_management.SastEnforcedOnChanges,
		},
	}
)

Functions

func AllSteps added in v0.21.0 

func AllSteps() map[string][]TypedStep

AllSteps merges every step map in this package into one map, keyed by assessment ID, for registration against all loaded catalogs.

One merged map is safe to register against every catalog: the SDK looks up steps by the requirement IDs a catalog declares, so IDs it does not declare are never run. It is also safe across OSPS Baseline versions, because the maintenance policy (https://github.com/ossf/security-baseline/blob/main/docs/maintenance.md#identifiers) gives a control a new identifier whenever its meaning changes substantially, so one implementation per ID holds for every version.

Every map merged here must take data.Payload; steps that consume a different payload type need their own registration call.

Types

type TypedStep added in v0.24.0 

type TypedStep func(data.Payload) (gemara.Result, string, gemara.ConfidenceLevel)

TypedStep is the signature every step in this plugin uses: it receives a fully-typed data.Payload instead of an untyped any. The SDK's typed registration helpers (pluginkit.AddEvaluationSuiteTyped and ...TypedForAllCatalogs) adapt it to gemara.AssessmentStep and perform the payload type assertion once, so steps need no payload guard of their own.

Always register through those helpers. Wrapping a TypedStep in a local closure erases its function name from the benchmark report and evaluation log; see pluginkit.FuncName for why.

Source Files

View all Source files

Directories

Path Synopsis
Package markdown holds text-scanning helpers shared by assessment steps that read prose out of repository documentation.
 Package markdown holds text-scanning helpers shared by assessment steps that read prose out of repository documentation.
osps
access_control
build_release
docs
governance
legal
quality
sec_assessment
vuln_management

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.