diff --git a/.bestpractices.json b/.bestpractices.json new file mode 100644 index 0000000..a65547b --- /dev/null +++ b/.bestpractices.json @@ -0,0 +1,136 @@ +{ + "description_good_status": "Met", + "description_good_justification": "README.md now opens with a concise project description and a consistent accessible header.", + "interact_status": "Met", + "interact_justification": "The README and GitHub repository provide project information and an issue channel.", + "contribution_status": "Met", + "contribution_justification": "A CONTRIBUTING file documents how to contribute.", + "contribution_requirements_status": "Met", + "contribution_requirements_justification": "Contribution requirements are documented in the CONTRIBUTING file.", + "floss_license_status": "Met", + "floss_license_justification": "The repository declares the project license.", + "floss_license_osi_status": "?", + "floss_license_osi_justification": "The license could not be identified automatically as OSI-approved.", + "license_location_status": "Met", + "license_location_justification": "A license file is tracked in the repository.", + "documentation_basics_status": "Met", + "documentation_basics_justification": "README documentation is tracked and receives the shared repository header and badge convention.", + "documentation_interface_status": "?", + "documentation_interface_justification": "Interface documentation varies by project and requires project-specific review beyond the repository-wide audit.", + "sites_https_status": "Met", + "sites_https_justification": "The project repository is delivered over HTTPS at https://github.com/dcondrey/posme-draft.", + "discussion_status": "Met", + "discussion_justification": "GitHub Issues provides a URL-addressable discussion channel.", + "english_status": "Met", + "english_justification": "Repository documentation and automation examined by this audit are written in English.", + "maintained_status": "Met", + "maintained_justification": "Repository activity is within the last two years.", + "repo_public_status": "Met", + "repo_public_justification": "The source repository is publicly readable at https://github.com/dcondrey/posme-draft.", + "repo_track_status": "Met", + "repo_track_justification": "Git tracks authorship, timestamps, commit messages, and diffs.", + "repo_interim_status": "Met", + "repo_interim_justification": "Git supports incremental, reviewable project history.", + "repo_distributed_status": "Met", + "repo_distributed_justification": "The project uses Git, a distributed version-control system.", + "version_unique_status": "?", + "version_unique_justification": "Version declaration and uniqueness require package-specific review.", + "version_semver_status": "?", + "version_semver_justification": "Version-number semantics require package-specific review.", + "version_tags_status": "Unmet", + "version_tags_justification": "No repository tags were found.", + "release_notes_status": "N/A", + "release_notes_justification": "No tagged release exists to evaluate.", + "release_notes_vulns_status": "N/A", + "release_notes_vulns_justification": "No tagged release exists to evaluate.", + "report_process_status": "?", + "report_process_justification": "GitHub Issues is enabled, but structured reporting instructions were not detected.", + "report_tracker_status": "Met", + "report_tracker_justification": "GitHub Issues provides a per-item tracker.", + "report_responses_status": "?", + "report_responses_justification": "Response-time performance requires historical issue review.", + "enhancement_responses_status": "?", + "enhancement_responses_justification": "Enhancement response-time performance requires historical issue review.", + "report_archive_status": "Met", + "report_archive_justification": "GitHub Issues provides a public searchable archive.", + "vulnerability_report_process_status": "Unmet", + "vulnerability_report_process_justification": "No SECURITY policy file was detected.", + "vulnerability_report_private_status": "?", + "vulnerability_report_private_justification": "A private vulnerability-reporting route was not established from repository files.", + "vulnerability_report_response_status": "?", + "vulnerability_report_response_justification": "Vulnerability response performance requires historical report review.", + "build_status": "Met", + "build_justification": "A standard build or package manifest is tracked.", + "build_common_tools_status": "Met", + "build_common_tools_justification": "The repository uses a commonly supported build manifest.", + "build_floss_tools_status": "?", + "build_floss_tools_justification": "Build-tool licensing requires dependency-level review.", + "test_status": "Unmet", + "test_justification": "No conventional test directory was detected.", + "test_invocation_status": "Unmet", + "test_invocation_justification": "No automated test invocation was detected.", + "test_most_status": "?", + "test_most_justification": "Coverage breadth and thresholds require coverage evidence.", + "test_continuous_integration_status": "Unmet", + "test_continuous_integration_justification": "No recognizable test command was found in GitHub Actions.", + "test_policy_status": "?", + "test_policy_justification": "A documented test-addition policy requires manual review.", + "tests_are_added_status": "?", + "tests_are_added_justification": "Test-addition history was not established.", + "tests_documented_added_status": "?", + "tests_documented_added_justification": "Documented expectations for adding tests were not established.", + "warnings_status": "Unmet", + "warnings_justification": "No lint or warning checker was detected in CI.", + "warnings_fixed_status": "?", + "warnings_fixed_justification": "Whether all warnings fail the build requires workflow-level policy review.", + "warnings_strict_status": "?", + "warnings_strict_justification": "Strict warning configuration requires language-specific review.", + "know_secure_design_status": "?", + "know_secure_design_justification": "Secure-design documentation was not identified automatically.", + "know_common_errors_status": "?", + "know_common_errors_justification": "Automated common-error detection was not identified.", + "crypto_published_status": "?", + "crypto_published_justification": "Project-specific review is required to determine cryptographic design publication and applicability.", + "crypto_call_status": "?", + "crypto_call_justification": "Project-specific review is required to determine cryptographic API design and applicability.", + "crypto_floss_status": "?", + "crypto_floss_justification": "Project-specific review is required to determine cryptographic implementation licensing and applicability.", + "crypto_keylength_status": "?", + "crypto_keylength_justification": "Project-specific review is required to determine cryptographic key-length selection and applicability.", + "crypto_working_status": "?", + "crypto_working_justification": "Project-specific review is required to determine cryptographic implementation validation and applicability.", + "crypto_weaknesses_status": "?", + "crypto_weaknesses_justification": "Project-specific review is required to determine cryptographic weakness review and applicability.", + "crypto_pfs_status": "?", + "crypto_pfs_justification": "Project-specific review is required to determine forward-secrecy requirements and applicability.", + "crypto_password_storage_status": "?", + "crypto_password_storage_justification": "Project-specific review is required to determine password-storage requirements and applicability.", + "crypto_random_status": "?", + "crypto_random_justification": "Project-specific review is required to determine cryptographic randomness requirements and applicability.", + "delivery_mitm_status": "Met", + "delivery_mitm_justification": "GitHub source delivery uses authenticated HTTPS or SSH transports.", + "delivery_unsigned_status": "Met", + "delivery_unsigned_justification": "No plain-HTTP software-delivery path was identified in this repository-level audit.", + "vulnerabilities_fixed_60_days_status": "?", + "vulnerabilities_fixed_60_days_justification": "Remediation timing requires historical vulnerability review.", + "vulnerabilities_critical_fixed_status": "?", + "vulnerabilities_critical_fixed_justification": "Critical-vulnerability remediation requires historical advisory review.", + "no_leaked_credentials_status": "?", + "no_leaked_credentials_justification": "Absence of leaked credentials cannot be proven from repository structure alone.", + "static_analysis_status": "Unmet", + "static_analysis_justification": "No recognizable static-analysis job was detected.", + "static_analysis_common_vulnerabilities_status": "Unmet", + "static_analysis_common_vulnerabilities_justification": "No static vulnerability analysis was detected.", + "static_analysis_fixed_status": "?", + "static_analysis_fixed_justification": "Finding-remediation policy requires workflow and history review.", + "static_analysis_often_status": "Unmet", + "static_analysis_often_justification": "Frequent automated static analysis was not detected.", + "dynamic_analysis_status": "Unmet", + "dynamic_analysis_justification": "No dedicated fuzzing or dynamic security-analysis job was detected.", + "dynamic_analysis_unsafe_status": "?", + "dynamic_analysis_unsafe_justification": "Memory-unsafe language use and dynamic-analysis applicability require project-specific review.", + "dynamic_analysis_enable_assertions_status": "?", + "dynamic_analysis_enable_assertions_justification": "Assertion configuration for dynamic-analysis builds requires project-specific review.", + "dynamic_analysis_fixed_status": "?", + "dynamic_analysis_fixed_justification": "Dynamic-analysis finding remediation requires historical review." +} diff --git a/README.md b/README.md index ebbe968..2e46522 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,14 @@ -# Proof of Sequential Memory Execution (PoSME) + +Proof of Sequential Memory Execution (PoSME) logo -This is the working area for the Independent Submission Internet-Draft, "Proof of Sequential Memory Execution (PoSME)", draft-condrey-posme. +

Proof of Sequential Memory Execution (PoSME)

+ +

Internet-Draft: Proof of Sequential Memory Execution (PoSME) - draft-condrey-cfrg-posme

+ +
+ +[![CI](https://img.shields.io/github/actions/workflow/status/dcondrey/posme-draft/publish.yml?style=flat-square&labelColor=20232a&branch=main&label=CI)](https://github.com/dcondrey/posme-draft/actions/workflows/publish.yml) [![Best Practices Evidence](https://img.shields.io/badge/best%20practices-evidence%20reviewed-6a4c93?style=flat-square&labelColor=20232a)](.bestpractices.json) [![IETF](https://img.shields.io/badge/standard-IETF%20draft-6a4c93?style=flat-square&labelColor=20232a)](https://datatracker.ietf.org/) [![GitHub Sponsors](https://img.shields.io/badge/GitHub%20Sponsors-Sponsor-EA4AAA?style=flat-square&labelColor=20232a)](https://github.com/sponsors/dcondrey) + * [Editor's Copy](https://dcondrey.github.io/posme-draft/#go.draft-condrey-posme.html) * [Datatracker Page](https://datatracker.ietf.org/doc/draft-condrey-posme)