From 712857decfd01690af2288844caf6a3d93eb4294 Mon Sep 17 00:00:00 2001 From: Satarupa22-SD Date: Thu, 3 Sep 2026 16:06:22 +0530 Subject: [PATCH 1/4] Update VM-05 to split dependency remediation enforcement into 4 areas Signed-off-by: Satarupa22-SD --- baseline/OSPS-VM.yaml | 51 ++++++++++++++++++++++++++++++++++++++----- 1 file changed, 45 insertions(+), 6 deletions(-) diff --git a/baseline/OSPS-VM.yaml b/baseline/OSPS-VM.yaml index b12969d6..e3f00437 100644 --- a/baseline/OSPS-VM.yaml +++ b/baseline/OSPS-VM.yaml @@ -142,19 +142,58 @@ controls: Composition Analysis results before any release, and add status checks that verify compliance with that policy prior to release. - id: OSPS-VM-05.03 + text: | + Retired in + applicability: + - maturity-3 + state: Retired + - id: OSPS-VM-05.04 text: | All changes to the project's codebase MUST be automatically evaluated against a documented policy for malicious - dependencies and known vulnerabilities in dependencies, then blocked - in the event of violations, except when declared and suppressed as - non-exploitable. + dependencies. applicability: - maturity-3 recommendation: | Create a status check in the project's version control system that - runs a Software Composition Analysis tool on all changes - to the codebase. Require that the status check passes before changes - can be merged. + runs a Software Composition Analysis tool to detect malicious + dependencies present in the codebase. Require that the status check + passes before any new changes can be merged. + - id: OSPS-VM-05.05 + text: | + All changes to the project's codebase MUST be + automatically evaluated against a documented policy for known + vulnerabilities in dependencies. + applicability: + - maturity-3 + recommendation: | + Create a status check in the project's version control system that + runs a Software Composition Analysis tool to detect known + vulnerabilities in dependencies. Require that the status check + passes before any new changes can be merged. + - id: OSPS-VM-05.06 + text: | + Changes to the codebase MUST be blocked when they violate the + documented policy for malicious dependencies or known + vulnerabilities. + applicability: + - maturity-3 + recommendation: | + Configure status checks to block any new changes from being merged + when the documented policy for malicious dependencies or known + vulnerabilities is violated. + - id: OSPS-VM-05.07 + text: | + A project MUST allow documented dependency policy violations to be + suppressed when they are declared non-exploitable. + applicability: + - maturity-3 + recommendation: | + Configure the status check in the project's version control system + that runs a Software Composition Analysis tool to support + documented suppressions for dependency policy violations that have + been determined to be non-exploitable. Require that the findings + and justifications are documented for each suppression. - id: OSPS-VM-06 title: | From d8bf79eb1a48e819ded8dea8cc312241f4403065 Mon Sep 17 00:00:00 2001 From: Satarupa22-SD Date: Thu, 3 Sep 2026 16:09:09 +0530 Subject: [PATCH 2/4] link pr Signed-off-by: Satarupa22-SD --- baseline/OSPS-VM.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/baseline/OSPS-VM.yaml b/baseline/OSPS-VM.yaml index e3f00437..e8f165fd 100644 --- a/baseline/OSPS-VM.yaml +++ b/baseline/OSPS-VM.yaml @@ -143,7 +143,7 @@ controls: that verify compliance with that policy prior to release. - id: OSPS-VM-05.03 text: | - Retired in + Retired in https://github.com/ossf/security-baseline/pull/553 applicability: - maturity-3 state: Retired From 34c78a817bd87711df65a95ed9148c456de40c9a Mon Sep 17 00:00:00 2001 From: Satarupa22-SD Date: Thu, 3 Sep 2026 16:47:32 +0530 Subject: [PATCH 3/4] update control-ids Signed-off-by: Satarupa22-SD --- baseline/OSPS-VM.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/baseline/OSPS-VM.yaml b/baseline/OSPS-VM.yaml index e8f165fd..ed4aed51 100644 --- a/baseline/OSPS-VM.yaml +++ b/baseline/OSPS-VM.yaml @@ -147,7 +147,7 @@ controls: applicability: - maturity-3 state: Retired - - id: OSPS-VM-05.04 + - id: OSPS-VM-05.06 text: | All changes to the project's codebase MUST be automatically evaluated against a documented policy for malicious @@ -159,7 +159,7 @@ controls: runs a Software Composition Analysis tool to detect malicious dependencies present in the codebase. Require that the status check passes before any new changes can be merged. - - id: OSPS-VM-05.05 + - id: OSPS-VM-05.07 text: | All changes to the project's codebase MUST be automatically evaluated against a documented policy for known @@ -171,7 +171,7 @@ controls: runs a Software Composition Analysis tool to detect known vulnerabilities in dependencies. Require that the status check passes before any new changes can be merged. - - id: OSPS-VM-05.06 + - id: OSPS-VM-05.08 text: | Changes to the codebase MUST be blocked when they violate the documented policy for malicious dependencies or known @@ -182,7 +182,7 @@ controls: Configure status checks to block any new changes from being merged when the documented policy for malicious dependencies or known vulnerabilities is violated. - - id: OSPS-VM-05.07 + - id: OSPS-VM-05.09 text: | A project MUST allow documented dependency policy violations to be suppressed when they are declared non-exploitable. From ea646ab105025adb36f52934647bfc1c61c2defa Mon Sep 17 00:00:00 2001 From: Satarupa22-SD Date: Fri, 2 Oct 2026 19:09:00 +0530 Subject: [PATCH 4/4] update OSPS-VM-05.03 Signed-off-by: Satarupa22-SD --- baseline/OSPS-VM.yaml | 44 +++++++++++++++++-------------------------- 1 file changed, 17 insertions(+), 27 deletions(-) diff --git a/baseline/OSPS-VM.yaml b/baseline/OSPS-VM.yaml index 04cfc5b8..8128fbef 100644 --- a/baseline/OSPS-VM.yaml +++ b/baseline/OSPS-VM.yaml @@ -165,28 +165,28 @@ controls: state: Retired - id: OSPS-VM-05.06 text: | - All changes to the project's codebase MUST be - automatically evaluated against a documented policy for malicious - dependencies. + All changes to the project's codebase MUST be automatically + evaluated against a documented policy for malicious dependencies. applicability: - maturity-3 recommendation: | Create a status check in the project's version control system that - runs a Software Composition Analysis tool to detect malicious - dependencies present in the codebase. Require that the status check - passes before any new changes can be merged. + runs a Software Composition Analysis tool on all changes to the + codebase to detect malicious dependencies, and configure it to + evaluate changes against the project's documented policy. - id: OSPS-VM-05.07 text: | - All changes to the project's codebase MUST be - automatically evaluated against a documented policy for known - vulnerabilities in dependencies. + All changes to the project's codebase MUST be automatically + evaluated against a documented policy for known vulnerabilities in + dependencies. applicability: - maturity-3 recommendation: | Create a status check in the project's version control system that - runs a Software Composition Analysis tool to detect known - vulnerabilities in dependencies. Require that the status check - passes before any new changes can be merged. + runs a Software Composition Analysis tool on all changes to the + codebase to detect known vulnerabilities in dependencies, and + configure it to evaluate changes against the project's documented + policy. - id: OSPS-VM-05.08 text: | Changes to the codebase MUST be blocked when they violate the @@ -195,21 +195,11 @@ controls: applicability: - maturity-3 recommendation: | - Configure status checks to block any new changes from being merged - when the documented policy for malicious dependencies or known - vulnerabilities is violated. - - id: OSPS-VM-05.09 - text: | - A project MUST allow documented dependency policy violations to be - suppressed when they are declared non-exploitable. - applicability: - - maturity-3 - recommendation: | - Configure the status check in the project's version control system - that runs a Software Composition Analysis tool to support - documented suppressions for dependency policy violations that have - been determined to be non-exploitable. Require that the findings - and justifications are documented for each suppression. + Configure the project's version control system to require that the + Software Composition Analysis status checks pass before changes can + be merged. The policy may allow findings to be suppressed (for + example, by documenting them in a VEX statement) when they are + determined to be non-exploitable. - id: OSPS-VM-06 title: |