Repository navigation
OpenSSF Best Practices Badge Program #13276
Replies: 3 comments 2 replies
|
@marcwrobel maybe some time in the future. Currently, our focus is on CNCF. See: #12975 |
|
@abstractj Just clarifying a bit about the scope of this, if there is any doubt: It is not that Keycloak would need to apply to an organization, similar to CNCF. It is just about entering project into the system by filling in self-evaluation form about the project. The form has questions how the project works in relation to given best practices criteria. These are commonly acknowledged best practices, so no rocket science :) The answers will be scored, which is then summarized by the "badge". Project is entered by logging in using github account and registering a new project. Since Keycloak is in github, few of the answers are automatically filled in. I know that some organizations evaluate and choose Open Source projects by using the best practices badge as input. I think it would be good investement of time if one of the project maintainers would take a moment to fill in the self-evaluation form. The purpose is just to communicate how Keycloak as a project thinks about these basic software development and security topics. I don't see reason why not enter the project into the system? |
|
Just to test this out, I just entered one of my own projects https://bestpractices.coreinfrastructure.org/en/projects/6334. It requires good knowledge of the software itself, its dependencies and about the working practices that the maintainer team is committed to. |
|
Here is another example for one of my project : https://bestpractices.coreinfrastructure.org/en/projects/6217. As @tsaarni said, it requires a good knowledge of every aspects of the project. FYI it took me 3 to 6 hours to answer all the questions (it was also the opportunity to improve a lot of things in my project). |
Uh oh!
There was an error while loading. Please reload this page.
The Open Source Security Foundation (OpenSSF) Best Practices badge is a way for Free/Libre and Open Source Software (FLOSS) projects to show that they follow security best practices. Many popular projects (such as Linux, GitLab, Prometheus, OpenSSL...) already joined this program and I think it would send a positive message to the users if Keycloak could join it too.
Is the Keycloak team aware this program exists ? Is it something you could consider ?
All reactions