p4gs/p4gs.github.io

Defences found, by attack group

This lists defences the scan found, not weaknesses it found. A missing defence is not a break-in, and a full set of checks is not safety: nine groups and 54 checks do not cover everything. What the nine groups are →

• A1 Poisoned commit All answered checks passed Every answered check passed — 5 of 5. 2 more produced no answer. No answer signing-model, scorecard — 1 of these only a maintainer's own machine can answer Every sscsb check here that produced an answer passed. That is not the same as being safe from this group.
• A2 Stolen publisher identity All answered checks passed Every answered check passed — 5 of 5. 1 more produced no answer. No answer signing-model — all of these only a maintainer's own machine can answer Every sscsb check here that produced an answer passed. That is not the same as being safe from this group.
• A3 Look-alike or invented package All answered checks passed Every check passed — 3 of 3. Every sscsb check here that produced an answer passed. That is not the same as being safe from this group.
• A4 A real dependency turns hostile, or stays broken All answered checks passed Every answered check passed — 9 of 9. 3 more produced no answer. No answer scorecard, bumblebee, openvex — 2 of these only a maintainer's own machine can answer Every sscsb check here that produced an answer passed. That is not the same as being safe from this group.
• A5 Hijacked build pipeline All answered checks passed Every answered check passed — 9 of 9. 1 more produced no answer. No answer scorecard Every sscsb check here that produced an answer passed. That is not the same as being safe from this group.
• A6 Compromised developer environment All answered checks passed Every answered check passed — 5 of 5. 2 more produced no answer. No answer signing-model, bumblebee — all of these only a maintainer's own machine can answer Every sscsb check here that produced an answer passed. That is not the same as being safe from this group.
• A7 Leaked credential All answered checks passed Every check passed — 5 of 5. Every sscsb check here that produced an answer passed. That is not the same as being safe from this group.
• A8 A flaw in the code you wrote All answered checks passed Every check passed — 3 of 3. Every sscsb check here that produced an answer passed. That is not the same as being safe from this group.
• A9 Untrustworthy delivery All answered checks passed Every check passed — 6 of 6. Every sscsb check here that produced an answer passed. That is not the same as being safe from this group.

These checks do not stop an attack. They let an outsider tell what a project already does, and where to report a problem. They are not in the list above: best-practices-badge, compliance-map, osps-baseline, publish-targets, secure-repo, security-insights.