Collaborating with OpenSSF and CNCF

[mlieberman85]

@ishaan-berri asked for help in OpenSSF Slack and I wanted to create an issue where we can discuss how we can help. I'm Mike Lieberman, a member of the Governing Board, Technical Advisory Council member, and contribute/maintain some projects underneath the OpenSSF.

In the short term, I really recommend looking at OpenSSF Baseline - https://baseline.openssf.org/ (@funnelfiasco). Getting documented processes in place ASAP will definitely help here.

I also think the results from stuff like Scorecard (@justaugustus) - https://scorecard.dev/ would help as well. It can help highlight some missing best practices.

Beyond that, if you have some sort of call to start drive some of these I'm sure various folks from OpenSSF would be happy to join and help. Similarly, we'd love to see folks from your end join some OpenSSF meetings to collect feedback and collaborate that way as well.

To copy John Kjell's (@jkjell) great ideas from the OpenSSF Slack:

First of all, I hope you and the team are doing ok. I can imagine it’s been a tough few days.

I’m John and I’m a co-chair to the CNCF’s TAG (technical advisory group) Security and Compliance group. We primarily focus on helping out projects in the CNCF but, I’d like to help you all out too.

I’ll share a bunch of information here for everyone. It’s probably going to be too much and overwhelming but, I’ll reach out directly to help work through the details if you’d like.

Moving to GitHub actions and using PyPi-publish to adopt trusted publishing is the best place to start!
I saw your PR to address results from using Zizmor. This is a great way to continue!
For general best practice around setting up security for your project, we have a set of recommendations available: https://contribute.cncf.io/projects/best-practices/security/
The Linux Foundation has a terrific and free course on how to perform a security self-assessment for your project: https://training.linuxfoundation.org/express-learning/security-self-assessments-for-open-source-projects-lfel1005/ (a huge thanks to @Justin Cappos for all his work on this)
There’s a list too long to share here of OpenSSF projects that can help: https://openssf.org/projects/. These projects can help document and verify implementing best practices the right way and help with ensuring they’re maintained over time.
These are some of the general recommendations I would make to any open source projects. So, hopefully if others are reading this, they’ll have some good references too.

CC: @SecurityCRob

[bureado]

Adding to this.

@ryanwaite built https://github.com/ryanwaite/openssf-skill/blob/main/.github/copilot-instructions.md a while back, so I ran it on BerriAI/litellm@88ed4f9 and also fed it @ramimac's write-ups.

The resulting patchset (all AI-generated) can be seen here: BerriAI/litellm@main...bureado:litellm:supply-chain-security-hardening in case it helps advance the discussion.

I have not run the workflows, so I can't attest that it works OOTB. Purportedly, it extends Dependabot to PyPI and NPM. It produces SLSA provenance and publishes them as build artifacts. It runs OpenSSF Scorecard, and uploads to Security Analysis. Uses Dependency Review. Breaks if it finds PTHs. Uses Gitleaks on pre-commit hooks.

[bureado]

I also went over https://www.stepsecurity.io/blog/litellm-credential-stealer-hidden-in-pypi-wheel to help address a few other aspects: integrity verification of trivy, and the use of harden-runner. In a scenario where the publishing workflow of the upstream dependency (trivy) is taken over, and the build isn't attested, integrity verification won't be helpful, but it's good for hygiene. Updated that for trivy and for grype. You can see those in bureado/litellm@1e47b58.

[DanielRuf]

I support this (already had to do with the Scorecard project and SLSA).

We have a nomination for @mihaimaruseac. But I think it makes sense to have a few more people from the OpenSSF project if this is ok for you.

Are you up for championing this (or some of the things) and would you like to nominate yourself?
You can create short introduction issue and describe your motivation and how you want to help. See also #6 and #7

If you can nominate someone else, the same applies.

Everyones resources are limited and we have different timezones so for me it is important to be efficient here.
Ideally you have the time, if not any input is very welcome even if you can not join the team and provide a bit of your valuable resources.

[mlieberman85]

Definitely +1 on @mihaimaruseac. I'm always happy to help, and will take a look at self-nominating when I get home (traveling back from KubeCon)

Also very early on, we are building along with some folks at NYU like @JustinCappos and @Marc-cn: https://github.com/kusari-oss/darnit (falling under neutral governance soon) which is intended to make applying the best practices from OpenSSF and similar much easier. It integrates some of the skills that @ryanwaite wrote that were mentioned previously along with being a framework for walking projects through better security practices.

[justaugustus]

I also think the results from stuff like Scorecard (@justaugustus) - https://scorecard.dev/ would help as well. It can help highlight some missing best practices.

Thanks for tagging me, @mlieberman85! 🚀

Great to meet you, @ishaan-berri!
Similar to Mike, I'm one of the OpenSSF Governing Board members, a Technical Advisory Council member, in addition to being one of the Steering Committee members and maintainers for OpenSSF Scorecard.

Outside of the recommendations already made by Mike and @jkjell, I'd recommend using Allstar (Scorecard's GitHub App) to start reporting repo health/security heuristics to maintainers —> https://github.com/ossf/allstar?tab=readme-ov-file#installation-options

We have a public instance of Allstar, but you can also run this self-hosted via your own infra or on cron via GitHub Actions.

If you're interested in being on the cutting edge and trying out a to-be-released feature, I'm working on making it possible for Allstar to upload its Scorecard findings to the GitHub Code Scanning tab.

Here's an example config for that (currently requires you to self-host the instance or run on GitHub Actions):

• allstar: enable SARIF upload for scorecard policy uwu-tools/.github#75
• ci: add Allstar enforcement action with SARIF upload uwu-tools/.github#77

Huge +1 for the zizmor recommendation (cc: @woodruffw)

I think you can get a lot of mileage out of good linters.
...with that in mind, consider Super-Linter, which happens to bundle zizmor.

Here's an example of reusable actions with Super-Linter: https://github.com/bloomberg/.github/blob/main/.github/workflows/lint.yml / https://github.com/bloomberg/.github/blob/main/.github/workflows/_lint.yml

[ishaan-berri]

Can someone help me setup allstar for us @justaugustus it's a good idea

[justaugustus]

Can someone help me setup allstar for us @justaugustus it's a good idea

@ishaan-berri — Happy to help! We have a quickstart template for Allstar —> https://github.com/ossf/dot-allstar-quickstart

If you "Use this template" to create a .allstar repository in the org, I can help out with some of the configuration.

Do note that certain actions will require coordination with an org owner e.g.,

• installing the OpenSSF Allstar GitHub App (going with the public instance)
• creating (and managing the creds) for your own instance of Allstar (self-hosted or via GitHub Actions)

Let me know which route you decide!

[SecurityCRob]

@ishaan-berri - It is nice to virtually meet you, I wish it was under more pleasant circumstances. I'm CRob, and I get to work with the wonderful folks here with the OpenSSF like @justaugustus , @mlieberman85 , @mihaimaruseac , and others. Once the initial dust and flurry of work settles down from all of these excellent suggestions, if you're interested in taking a step back and thinking about your security program and about other processes and tools your community may wish to adopt, please let us know. We're very glad to setup some time to convene all the big brains from all sides to review what you all are doing and give suggestions on where you may wish to augment or add.

[krrish-berri-2]

@SecurityCRob that'd be great. We're pushing several improvements as we speak. Happy to circle back to this, once we've finished our sprint.