chore: add OpenSSF trust baseline #10
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| { | ||
| "osps_do_01_01": "Met", | ||
| "osps_do_01_01_justification": "Install, configuration and tool usage are documented in README.md and docs/.", | ||
| "osps_do_02_01": "Met", | ||
| "osps_do_02_01_justification": "Defects use public issues under the process in SUPPORT.md.", | ||
| "osps_gv_02_01": "Met", | ||
| "osps_gv_02_01_justification": "Public issues and pull requests are enabled.", | ||
| "osps_gv_03_01": "Met", | ||
| "osps_gv_03_01_justification": "See https://github.com/gexiro-global/pc-filebridge/blob/main/CONTRIBUTING.md", | ||
| "osps_le_02_01": "Met", | ||
| "osps_le_02_01_justification": "Apache-2.0 source license.", | ||
| "osps_le_02_02": "Met", | ||
| "osps_le_02_02_justification": "Release artifacts include the Apache-2.0 license.", | ||
| "osps_le_03_01": "Met", | ||
| "osps_le_03_01_justification": "See https://github.com/gexiro-global/pc-filebridge/blob/main/LICENSE", | ||
| "osps_le_03_02": "Met", | ||
| "osps_le_03_02_justification": "The license is included in release source and runtime packages.", | ||
| "osps_qa_01_01": "Met", | ||
| "osps_qa_01_01_justification": "Canonical public source: https://github.com/gexiro-global/pc-filebridge", | ||
| "osps_qa_01_02": "Met", | ||
| "osps_qa_01_02_justification": "GitHub publishes the repository commit history.", | ||
| "osps_qa_02_01": "Met", | ||
| "osps_qa_02_01_justification": "Direct dependencies are declared in package.json and package-lock.json.", | ||
| "osps_qa_04_01": "N/A", | ||
| "osps_qa_04_01_justification": "PC FileBridge is a single-repository project.", | ||
| "osps_qa_05_01": "Met", | ||
| "osps_qa_05_01_justification": "Generated executables and packages are built in CI and not committed.", | ||
| "osps_qa_05_02": "Met", | ||
| "osps_qa_05_02_justification": "The repository contains source and reviewable configuration, not executable binaries.", | ||
| "osps_vm_02_01": "Met", | ||
| "osps_vm_02_01_justification": "See https://github.com/gexiro-global/pc-filebridge/blob/main/SECURITY.md" | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| name: OpenSSF Scorecard | ||
|
|
||
| on: | ||
| branch_protection_rule: | ||
| schedule: | ||
| - cron: "49 5 * * 3" | ||
| push: | ||
| branches: [main] | ||
|
|
||
| permissions: read-all | ||
|
|
||
| jobs: | ||
| analysis: | ||
| name: Scorecard analysis | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 15 | ||
| permissions: | ||
| contents: read | ||
| security-events: write | ||
| id-token: write | ||
| steps: | ||
| - name: Check out repository | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| persist-credentials: false | ||
| - name: Run OpenSSF Scorecard | ||
| uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 | ||
| with: | ||
| results_file: results.sarif | ||
| results_format: sarif | ||
| publish_results: true | ||
| - name: Preserve SARIF result | ||
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | ||
| with: | ||
| name: openssf-scorecard-sarif | ||
| path: results.sarif | ||
| retention-days: 5 | ||
| if-no-files-found: error | ||
| - name: Upload SARIF to code scanning | ||
| uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 | ||
| with: | ||
| sarif_file: results.sarif |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| # Governance | ||
|
|
||
| PC FileBridge is maintained by Gexiro Global Enterprises Ltd. The maintainer reviews issues and pull requests, decides scope and releases, and may reject changes that weaken create-only filesystem semantics, root confinement, identity checks, bounded operations or secret handling. | ||
|
|
||
| Changes are proposed through GitHub pull requests and must pass CI. The current single-maintainer structure is disclosed in [MAINTAINERS.md](MAINTAINERS.md); no independent review, response-time guarantee or certification is claimed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| # Maintainers | ||
|
|
||
| | Maintainer | Role | Contact | | ||
| |---|---|---| | ||
| | `@dzeusking-dev` | Project owner and release maintainer | [GitHub](https://github.com/dzeusking-dev) | | ||
|
|
||
| Security reports must use [SECURITY.md](SECURITY.md), not public issues. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| # Security and trust evidence | ||
|
|
||
| This page is an evidence index, not a certification. The evidence does not prove the project is vulnerability-free, does not establish a SLSA level, and does not imply OpenSSF affiliation or endorsement. Tool output describes observed posture; it is not proof of compromise or absence of compromise. | ||
|
|
||
| - [Security policy](../SECURITY.md), [threat model](../THREAT_MODEL.md), [architecture](../ARCHITECTURE.md) and [privacy policy](../PRIVACY.md) | ||
| - [Contribution process](../CONTRIBUTING.md), [governance](../GOVERNANCE.md), [maintainers](../MAINTAINERS.md) and [support](../SUPPORT.md) | ||
| - CI verifies type safety, tests, secret scanning, package contents, configuration contracts, MCP surface and image vulnerability policy. | ||
| - CodeQL, dependency review, Dependabot, secret scanning and OpenSSF Scorecard are configured. | ||
| - Third-party actions are pinned to immutable commit SHAs with version comments. | ||
|
|
||
| The Scorecard badge is intentionally withheld until a successful default-branch run has produced a public API result. `.bestpractices.json` contains evidence-backed automation proposals only; it is not an OpenSSF Best Practices or OSPS Baseline claim. A human must review any badge submission. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,64 @@ | ||
| header: | ||
| schema-version: 2.2.0 | ||
| last-updated: '2026-09-04' | ||
| last-reviewed: '2026-09-04' | ||
| url: https://raw.githubusercontent.com/gexiro-global/pc-filebridge/main/security-insights.yml | ||
| comment: This single-repository file reports current practices and makes no certification claim. | ||
| project: | ||
| name: PC FileBridge | ||
| homepage: https://github.com/gexiro-global/pc-filebridge | ||
| administrators: | ||
| - name: dzeusking-dev | ||
| affiliation: Gexiro Global Enterprises Ltd. | ||
| social: https://github.com/dzeusking-dev | ||
| primary: true | ||
| documentation: | ||
| quickstart-guide: https://github.com/gexiro-global/pc-filebridge#install-and-configure | ||
| detailed-guide: https://github.com/gexiro-global/pc-filebridge/blob/main/ARCHITECTURE.md | ||
| code-of-conduct: https://github.com/gexiro-global/pc-filebridge/blob/main/CODE_OF_CONDUCT.md | ||
| release-process: https://github.com/gexiro-global/pc-filebridge/blob/main/docs/RELEASE_PROCESS.md | ||
| support-policy: https://github.com/gexiro-global/pc-filebridge/blob/main/SUPPORT.md | ||
| signature-verification: https://github.com/gexiro-global/pc-filebridge/blob/main/docs/RELEASE_VERIFICATION.md | ||
| repositories: | ||
| - name: pc-filebridge | ||
| url: https://github.com/gexiro-global/pc-filebridge | ||
| comment: Canonical source and release repository. | ||
| vulnerability-reporting: | ||
| reports-accepted: true | ||
| bug-bounty-available: false | ||
| policy: https://github.com/gexiro-global/pc-filebridge/blob/main/SECURITY.md | ||
| repository: | ||
| url: https://github.com/gexiro-global/pc-filebridge | ||
| status: active | ||
| accepts-change-request: true | ||
| accepts-automated-change-request: true | ||
| no-third-party-packages: false | ||
| core-team: | ||
| - name: dzeusking-dev | ||
| affiliation: Gexiro Global Enterprises Ltd. | ||
| social: https://github.com/dzeusking-dev | ||
| primary: true | ||
| documentation: | ||
| contributing-guide: https://github.com/gexiro-global/pc-filebridge/blob/main/CONTRIBUTING.md | ||
| review-policy: https://github.com/gexiro-global/pc-filebridge/blob/main/GOVERNANCE.md | ||
| security-policy: https://github.com/gexiro-global/pc-filebridge/blob/main/SECURITY.md | ||
| governance: https://github.com/gexiro-global/pc-filebridge/blob/main/GOVERNANCE.md | ||
| dependency-management-policy: https://github.com/gexiro-global/pc-filebridge/blob/main/docs/SECURITY-TRUST.md | ||
| license: | ||
| url: https://github.com/gexiro-global/pc-filebridge/blob/main/LICENSE | ||
| expression: Apache-2.0 | ||
| release: | ||
| changelog: https://github.com/gexiro-global/pc-filebridge/blob/main/CHANGELOG.md | ||
| automated-pipeline: true | ||
| distribution-points: | ||
| - uri: https://github.com/gexiro-global/pc-filebridge/releases | ||
| comment: Versioned GitHub release assets. | ||
| attestations: | ||
| - name: GitHub build provenance | ||
| predicate-uri: https://slsa.dev/provenance/v1 | ||
| location: https://github.com/gexiro-global/pc-filebridge/attestations | ||
| comment: Verify the selected release asset against this repository and tag. | ||
| security: | ||
| assessments: | ||
| self: | ||
| comment: Maintainer self-assessment only; no independent audit is claimed. |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If this questionnaire is imported or submitted, it reports false compliance: the
buildscript inpackage.jsongeneratesmcp/server.mjswith esbuild, while that generated runtime is tracked in the repository and included in the package.osps_qa_05_01should not be markedMetunless the artifact is removed; if it remains,osps_qa_05_02needs actual provenance evidence rather than the contradictory claim that no executable artifacts are present.Useful? React with 👍 / 👎.