diff --git a/SECURITY-INSIGHTS.yml b/SECURITY-INSIGHTS.yml index cf55b9bd..91742d4e 100644 --- a/SECURITY-INSIGHTS.yml +++ b/SECURITY-INSIGHTS.yml @@ -15,10 +15,67 @@ header: schema-version: 1.0.0 expiration-date: '2024-08-31T10:10:09.000Z' - last-updated: '2023-12-06' - last-reviewed: '2023-12-06' + last-updated: '2023-12-17' + last-reviewed: '2023-12-17' commit-hash: cd0c222058a8830a8e190b840e466098b25a3c41 project-url: https://github.com/in-toto/go-witness - project-release: 'v0.17.0' - changelog: https://github.com/in-toto/go-witness/releases/tag/v0.17.0 + project-release: 'v0.2.0' + changelog: https://github.com/in-toto/go-witness/releases/tag/v0.2.0 license: https://github.com/in-toto/go-witness/blob/main/LICENSE + +project-lifecycle: + status: active + roadmap: https://github.com/orgs/in-toto/projects/4/views/3 + bug-fixes-only: false + core-maintainers: + - https://github.com/in-toto/go-witness/MAINTAINERS.md + release-cycle: https://github.com/in-toto/go-witness/releases + +contribution-policy: + accepts-pull-requests: true + accepts-automated-pull-requests: true + contributing-policy: https://github.com/in-toto/go-witness/blob/main/CONTRIBUTING.md + code-of-conduct: https://github.com/in-toto/go-witness/blob/main/CODE_OF_CONDUCT.md + +documentation: + - https://witness.dev + +distribution-points: + - https://github.com/in-toto/go-witness/releases + +security-testing: +- tool-type: sca + tool-name: Dependabot + tool-version: 2 + tool-url: https://github.com/dependabot + integration: + ad-hoc: false + ci: true + before-release: false + +security-contacts: +- type: email + value: security@testifysec.com + primary: true + +vulnerability-reporting: + accepts-vulnerability-reports: true + email-contact: security@testifysec.com + security-policy: https://github.com/in-toto/go-witness/SECURITY.md + +dependencies: + third-party-packages: true + dependencies-lists: + - https://github.com/in-toto/go-witness/go.mod + sbom: + - sbom-file: https://foo.bar/sbom + sbom-format: CycloneDX + sbom-url: https://foo.bar + dependencies-lifecycle: + policy-url: https://github.com/in-toto/go-witness/SECURITY.md + comment: | + All dependencies are subject to the Witness Security Policy. + env-dependencies-policy: + policy-url: https://github.com/in-toto/go-witness/SECURITY.md + comment: | + All dependencies are subject to the Witness Security Policy.