evankanderson

# OpenSSF Minder Individual Contributor License Agreement
"You" (or "Your") shall mean the copyright owner or legal entity authorized by the copyright owner that is making this Agreement with Stacklok. For legal entities, the entity making a Contribution and all other entities that control, are controlled by, or are under common control with that entity are considered to be a single Contributor. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.

In consideration of the opportunity to participate in the community of contributors to OpenSSF Minder projects, You accept and agree to the following terms and conditions for Your present and future Contributions submitted to OpenSSF Minder. Except for the license granted herein to OpenSSF Minder and recipients of software di

evankanderson

3. Basic Requirements

The basic authorization pattern serves as a minimum bar for application of IAM principles to a cloud-native application. In this model, authentication and authorization is performed primarily by the primary workload which receives the user's access token or session state. Note that the authentication and authorization (PEP) is performed by the workload using resource-specific parameters supplied to the PDP, and is not implemented by ingress or gateway rules which only have access to the request context.

3.1. Common Requirements

Implement the requirements from FAPI and RFC 9700. For human users, apply the appropriate assurance levels from NIST SP800-63.

note: this covers TLS (FAPI), ID verification (SP800-63A), multiple auth factors (SP800-63B), federation security (SP800-63C), authorization code flow (RFC9700), including many other requirements not currently specified in the whitepaper.

Implement authorization (PEP) using a consistent framework or patter

evankanderson

Open Source Project Security Baseline

Version: devel

{: .warning} Not for production use.

<button onclick="toTop()" id="topButton" title="Go to top" style="display: none; position: fixed; bottom: 20px; right: 30px; border: none; background-color: CornflowerBlue; color: white; cursor: pointer; padding: 10px; border-radius: 10px; font-size: 18px;">to top

evankanderson

--- docs/versions/2025-02-25.md	2025-10-13 12:41:28.344206651 -0700
+++ docs/versions/2025-10-10.md	2025-10-13 12:41:28.344707215 -0700
@@ -1,10 +1,14 @@
+---
+nav-title: Current Version
+---
 
 # Open Source Project Security Baseline
 
-Version: 2025-02-25

evankanderson

{
    "_type": "https://in-toto.io/Statement/v1",
    "subject": [
        {
            "name": "software",
            "uri": "https://github.com/mindersec/minder"
        },
        {
            "name": "governance",
            "uri": "https://github.com/mindersec/community"

evankanderson

...
  - name: config-provider
    templateRef:
      kind: ClusterConfigTemplate
      name: convention-template
    params:
    - name: serviceAccount
      value: default
    images:
    - resource: image-provider

evankanderson

#!/bin/sh

# Assumes Docker desktop installed
#

VARIANT="$(uname -sm | tr 'A-Z ' 'a-z-' | sed s/aarch64/arm64/ | sed s/x86_64/amd64/)"
FUNC_VARIANT="$(echo $VARIANT | tr '-' '_')"

curl -L -o kn https://github.com/knative/client/releases/download/knative-v1.2.0/kn-$VARIANT
curl -L -o kn-plugin-quickstart https://github.com/knative-sandbox/kn-plugin-quickstart/releases/download/knative-v1.2.0/kn-quickstart-$VARIANT

evankanderson

serving-istio:
  primary:
    github:
      repo: "knative/serving"
    include:
      - ".*.yaml"
    exclude:
      - "monitoring.*"
      - "serving.yaml"
      - "serving-storage-version-migration.yaml"

evankanderson

kn service update hello \
  --env TARGET="Knative from v2" \
  --revision-name hello-v2 \
  --tag hello-v2=v2 \
  --tag $(kubectl get ksvc hello --template='{{.status.latestReadyRevisionName}}')=v1 \
  --traffic v1=75,v2=25

evankanderson

{"client":"github","component":"unset","file":"prow/github/client.go:562","func":"k8s.io/test-infra/prow/github.(*client).log","level":"info","msg":"GetOrg(knative-sandbox)","time":"2020-05-20T06:26:35-07:00"}
{"client":"github","component":"unset","file":"prow/github/client.go:562","func":"k8s.io/test-infra/prow/github.(*client).log","level":"info","msg":"ListOrgInvitations(knative-sandbox)","time":"2020-05-20T06:26:35-07:00"}
{"client":"github","component":"unset","file":"prow/github/client.go:562","func":"k8s.io/test-infra/prow/github.(*client).log","level":"info","msg":"User()","time":"2020-05-20T06:26:36-07:00"}
{"client":"github","component":"unset","file":"prow/github/client.go:562","func":"k8s.io/test-infra/prow/github.(*client).log","level":"info","msg":"ListOrgMembers(knative-sandbox, admin)","time":"2020-05-20T06:26:37-07:00"}
{"client":"github","component":"unset","file":"prow/github/client.go:562","func":"k8s.io/test-infra/prow/github.(*client).log","level":"info","msg":"ListOrgMembers(knative-sa