From 57b5fe51e909aefa08e701d866a06d91104fe98d Mon Sep 17 00:00:00 2001 From: Travis Truman Date: Wed, 13 Aug 2025 08:14:16 -0400 Subject: [PATCH 1/4] feat: add control OSPS-QA-08 for secrets management This change adds a new control to the Build & Release control family that focuses on secure handling and storage of project secrets. This change closes #352 Signed-off-by: Travis Truman --- baseline/OSPS-BR.yaml | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/baseline/OSPS-BR.yaml b/baseline/OSPS-BR.yaml index e885527f..fa445705 100644 --- a/baseline/OSPS-BR.yaml +++ b/baseline/OSPS-BR.yaml @@ -465,3 +465,36 @@ controls: signature or attestations, such as GPG or PGP signature, Sigstore signatures, SLSA provenance, or SLSA VSAs. Include the cryptographic hashes of each asset in a signed manifest or metadata file. + - id: OSPS-BR-07 + title: | + The project MUST store and manage all secrets and credentials used by the project in a secure manner. + objective: | + Ensure that sensitive data is not disclosed, compromised or misused leading to security vulnerabilities or data breaches. + guideline-mappings: + - reference-id: BPB + identifiers: + - S-B-5 # TODO: is this the right numbering for https://www.bestpractices.dev/en/criteria#0.no_leaked_credentials + - reference-id: SSDF + identifiers: + - PO.1.1 + - P0.3.1 + - P0.4.2 + - PO.5.1 + - PW.1.2 + - PW.1.3 + - PW.5.1 + assessment-requirements: + - id: OSPS-BR-07.01 + text: | + The project MUST define a policy for managing secrets and credentials used by the project. The policy should include guidelines for storing, accessing, and rotating secrets and credentials. + applicability: + - Maturity Level 3 + recommendation: | + Document how secrets and credentials are managed and used within the project. This should include details on how secrets are stored (e.g., using a secrets management tool), how access is controlled, and how secrets are rotated or updated. Ensure that sensitive information is not hard-coded in the source code or stored in version control systems. + - id: OSPS-BR-07.02 + text: | + The project MUST prevent the unintentional storage of unencrypted sensitive data, such as secrets and credentials, in the version control system. + applicability: + - Maturity Level 1 + recommendation: | + Configure .gitignore or equivalent to exclude files that may contain sensitive information. Use pre-commit hooks and automated scanning tools to detect and prevent the inclusion of sensitive data in commits. Periodically audit the version control history to ensure that no sensitive information has been inadvertently committed. From 2d30186960e3ecd029b1799c6bf53162e616fd9f Mon Sep 17 00:00:00 2001 From: Travis Truman Date: Thu, 4 Sep 2025 22:37:46 -0400 Subject: [PATCH 2/4] Update OSPS-BR.yaml Co-authored-by: Evan Anderson Signed-off-by: Travis Truman --- baseline/OSPS-BR.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/baseline/OSPS-BR.yaml b/baseline/OSPS-BR.yaml index fa445705..c199a601 100644 --- a/baseline/OSPS-BR.yaml +++ b/baseline/OSPS-BR.yaml @@ -490,7 +490,7 @@ controls: applicability: - Maturity Level 3 recommendation: | - Document how secrets and credentials are managed and used within the project. This should include details on how secrets are stored (e.g., using a secrets management tool), how access is controlled, and how secrets are rotated or updated. Ensure that sensitive information is not hard-coded in the source code or stored in version control systems. + Document how secrets and credentials are managed and used within the project. This should include details on how secrets are stored (e.g., using a secrets management tool), how access is controlled, and how secrets are rotated or updated. - id: OSPS-BR-07.02 text: | The project MUST prevent the unintentional storage of unencrypted sensitive data, such as secrets and credentials, in the version control system. From 52d170a5203a1f9925342200d760dd6e3e76cd4b Mon Sep 17 00:00:00 2001 From: Travis Truman Date: Thu, 4 Sep 2025 22:38:47 -0400 Subject: [PATCH 3/4] Update OSPS-BR.yaml Co-authored-by: Evan Anderson Signed-off-by: Travis Truman --- baseline/OSPS-BR.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/baseline/OSPS-BR.yaml b/baseline/OSPS-BR.yaml index c199a601..6601a81f 100644 --- a/baseline/OSPS-BR.yaml +++ b/baseline/OSPS-BR.yaml @@ -469,7 +469,7 @@ controls: title: | The project MUST store and manage all secrets and credentials used by the project in a secure manner. objective: | - Ensure that sensitive data is not disclosed, compromised or misused leading to security vulnerabilities or data breaches. + Ensure that sensitive data is not disclosed, compromised or misused leading to security vulnerabilities or supply chain compromise. guideline-mappings: - reference-id: BPB identifiers: From bd026c02e9c18f46c3f7aee4fa0c6ca279807391 Mon Sep 17 00:00:00 2001 From: Travis Truman Date: Fri, 5 Sep 2025 07:47:54 -0400 Subject: [PATCH 4/4] chore: resequence controls Signed-off-by: Travis Truman --- baseline/OSPS-BR.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/baseline/OSPS-BR.yaml b/baseline/OSPS-BR.yaml index 6601a81f..766a647d 100644 --- a/baseline/OSPS-BR.yaml +++ b/baseline/OSPS-BR.yaml @@ -486,15 +486,15 @@ controls: assessment-requirements: - id: OSPS-BR-07.01 text: | - The project MUST define a policy for managing secrets and credentials used by the project. The policy should include guidelines for storing, accessing, and rotating secrets and credentials. + The project MUST prevent the unintentional storage of unencrypted sensitive data, such as secrets and credentials, in the version control system. applicability: - - Maturity Level 3 + - Maturity Level 1 recommendation: | - Document how secrets and credentials are managed and used within the project. This should include details on how secrets are stored (e.g., using a secrets management tool), how access is controlled, and how secrets are rotated or updated. + Configure .gitignore or equivalent to exclude files that may contain sensitive information. Use pre-commit hooks and automated scanning tools to detect and prevent the inclusion of sensitive data in commits. - id: OSPS-BR-07.02 text: | - The project MUST prevent the unintentional storage of unencrypted sensitive data, such as secrets and credentials, in the version control system. + The project MUST define a policy for managing secrets and credentials used by the project. The policy should include guidelines for storing, accessing, and rotating secrets and credentials. applicability: - - Maturity Level 1 + - Maturity Level 3 recommendation: | - Configure .gitignore or equivalent to exclude files that may contain sensitive information. Use pre-commit hooks and automated scanning tools to detect and prevent the inclusion of sensitive data in commits. Periodically audit the version control history to ensure that no sensitive information has been inadvertently committed. + Document how secrets and credentials are managed and used within the project. This should include details on how secrets are stored (e.g., using a secrets management tool), how access is controlled, and how secrets are rotated or updated. Ensure that sensitive information is not hard-coded in the source code or stored in version control systems.