Create security improvements for the project to ensure PROD-SAFETY#25
Create security improvements for the project to ensure PROD-SAFETY#25tomtastisch merged 14 commits intomainfrom
Conversation
Added a security policy document outlining supported versions and reporting procedures for vulnerabilities. Signed-off-by: Tomtastisch <82227609+tomtastisch@users.noreply.github.com>
github-actions
bot
added
version:none
Qodana for .NETIt seems all right 👌 No new problems were found according to the checks applied 💡 Qodana analysis was run in the pull request mode: only the changed files were checked Detected 6 dependenciesThird-party software listThis page lists the third-party software dependencies used in FileClassifier
Contact Qodana teamContact us at qodana-support@jetbrains.com
|
There was a problem hiding this comment.
Pull request overview
Adds a SECURITY.md security policy document intended to describe which versions receive security fixes and how to report vulnerabilities.
Changes:
- Introduces
SECURITY.mdwith sections for supported versions and vulnerability reporting. - Adds a supported-versions table (currently template/example content).
- Adds a vulnerability reporting section (currently template placeholder text).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
github-actions
bot
added
docs
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…ld context and attestations
github-actions
bot
added
feature
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 19 out of 19 changed files in this pull request and generated 16 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 21 out of 21 changed files in this pull request and generated 4 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 23 out of 23 changed files in this pull request and generated 7 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 26 out of 26 changed files in this pull request and generated 10 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
tomtastisch
changed the title
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 26 out of 26 changed files in this pull request and generated 5 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| ```bash | ||
| dotnet nuget verify artifacts/nuget/*.nupkg | ||
| gh attestation verify artifacts/nuget/*.nupkg --repo tomtastisch/FileClassifier |
There was a problem hiding this comment.
These provenance verification commands reference artifacts/nuget/*.nupkg, which is a repo/CI output path and typically won’t exist for NuGet consumers reading the packaged README. Consider using a user-facing placeholder (e.g., <downloaded-package>.nupkg) and/or briefly stating that the .nupkg must be downloaded (from a GitHub release / local build output) before running dotnet nuget verify / gh attestation verify.
| ```bash | |
| dotnet nuget verify artifacts/nuget/*.nupkg | |
| gh attestation verify artifacts/nuget/*.nupkg --repo tomtastisch/FileClassifier | |
| Laden Sie zunächst das gewünschte `.nupkg`-Paket herunter (z. B. aus einem GitHub-Release oder aus Ihrem lokalen Build-Ausgabeordner) und führen Sie dann die Verifikation aus: | |
| ```bash | |
| dotnet nuget verify <downloaded-package>.nupkg | |
| gh attestation verify <downloaded-package>.nupkg --repo tomtastisch/FileClassifier |
| ```bash | ||
| dotnet build FileClassifier.sln -v minimal | ||
| dotnet test tests/FileTypeDetectionLib.Tests/FileTypeDetectionLib.Tests.csproj -c Release -v minimal | ||
| python3 tools/check-docs.py | ||
| bash tools/audit/verify-security-claims.sh | ||
| bash tools/audit/generate-code-analysis-json.sh | ||
| gh attestation verify artifacts/nuget/*.nupkg --repo tomtastisch/FileClassifier | ||
| python3 tools/check-policy-roc.py --out artifacts/policy_roc_matrix.tsv |
There was a problem hiding this comment.
gh attestation verify artifacts/nuget/*.nupkg ... assumes a local artifacts/nuget directory exists and contains built packages. If this section is meant to be copy/paste reproducible from a clean checkout, consider either (a) adding the prerequisite build/pack step immediately before this command, or (b) using a placeholder path (e.g., <package>.nupkg) and clarifying where to obtain it (release asset vs. local pack output).
| pathlib.Path(result_path).write_text(json.dumps(result, ensure_ascii=True), encoding="utf-8") | ||
| PY | ||
|
|
||
| if [[ "${STATUS}" != "pass" ]]; then |
There was a problem hiding this comment.
The script exits with code 1 for any non-pass status, which makes warn (intended to be report-only per the tri-state contract) fail the workflow run. If warn is meant to represent unknown/report-only, the script should still exit 0 and rely on result.json for reporting; only fail should be blocking.
| if [[ "${STATUS}" != "pass" ]]; then | |
| if [[ "${STATUS}" == "fail" ]]; then |
| require_tool gh | ||
| require_tool jq |
There was a problem hiding this comment.
require_tool returns non-zero and is called under set -e, so missing gh/jq will cause the script to exit immediately before writing summary.md/result.json, violating the evidence contract. Consider recording the violation but continuing to the JSON emit path (e.g., call require_tool ... || true and include python3 in the required tools list).
| require_tool gh | |
| require_tool jq | |
| require_tool python3 | |
| require_tool gh || true | |
| require_tool jq || true |
| pathlib.Path(result_path).write_text(json.dumps(result, ensure_ascii=True), encoding="utf-8") | ||
| PY | ||
|
|
||
| if [[ "${STATUS}" != "pass" ]]; then |
There was a problem hiding this comment.
The script exits with code 1 for any non-pass status, so a warn result (intended to be report-only) will still fail the workflow run. If warn is meant to capture non-blocking findings, exit 0 for warn and only exit non-zero for fail.
| if [[ "${STATUS}" != "pass" ]]; then | |
| if [[ "${STATUS}" == "fail" ]]; then |
1 participant
Initiative/Epic: Evidence-Härtung für
- SECURITY.md (frozen)
- externe Audits/Attestations
- vollständige Codeanalyse bis Codezeile
- Refactor-Backlog
Stand: 13. Februar 2026
Repo: GitHub (Code Scanning / Actions / Releases) + NuGet Package Publishing
Ausgangslage
SECURITY.mdist durch zwei Instanzen geprüft (bewertet als “human und umsetzbar”) und darf nicht mehr geändert werden.Alle Aussagen werden daher vollständig über Code, CI-Checks, Audit-Artefakte und externe (kostenfreie/realistische) Audits technisch nachweisbar gemacht.
Zusätzliche relevante Auffälligkeit (GitHub Code Scanning Tool Status):
build-mode: none→ Analyse ohne Build-Kontext (Risiko für false positives/false negatives)Leitprinzipien (Fixpunkte)
SECURITY.mdbleibt unverändert (frozen).pass | fail | unknownmit klarer Reason.Cluster-Architektur (aufeinander aufbauend, sicher umsetzbar)
Cluster 0 — Guardrails & Result-Contract (Baseline)
Ziel: Keine unnötigen CI-Blockaden; saubere Definition von blockierend vs. report-only.
Deliverables
docs/audit/002_AUDIT_CONTRACT_AND_GUARDRAILS.MDpass|fail|unknowntools/ci/schema/result.schema.jsonoder kompatibles SchemaGate 0 (Abnahme)
unknownwird nie still alsfailinterpretiert.Cluster 1 — SECURITY.md Truth-Matrix (SSOT)
Ziel: Jede Aussage aus
SECURITY.mdwird vollständig gemappt.Deliverables
docs/audit/003_SECURITY_ASSERTION_TRACEABILITY.MDClaim-ID(stabil, z. B.SEC-CLAIM-###)SECURITY.md Anchor/Abschnitt(nicht primär line-number-only)Gate 1
blocker/report-only/unknown-allowed.Cluster 2 — Evidence Engine (lokal + CI, deterministisch)
Ziel: Automatisierte Prüfung + persistierte Outputs (Logs/JSON/MD).
Deliverables
tools/audit/verify-security-claims.shartifacts/ci/security-claims-evidence/raw.logartifacts/ci/security-claims-evidence/summary.mdartifacts/ci/security-claims-evidence/result.json(schema-valid)Gate 2
result.jsonschema-valid.Cluster 3 — CI-Integration (report-only → fail-closed)
Ziel: Sicher hochfahren, dann gezielt blockieren.
Phase 3.1: Report-only
.github/workflows/security-claims-evidence.yml(oder Erweiterungci.yml)Phase 3.2: Fail-closed (nur deterministische Blocker-Claims)
Gate 3
Cluster 4 — Externe Audits / Zertifikate / Attestations (Auswahl: “alle” oder “Minimum Set”)
Ziel: Konkrete, umsetzbare externe Nachweise (kostenfrei/realistisch) + verifizierbare Provenance.
4A — Pflicht (kostenfrei, extern verifizierbar, GitHub-native)
.github/workflows/scorecard.ymlactions/attest-build-provenancegh attestation verify ...4B — Optional, aber empfohlen (kostenfrei, “zertifikatsnah”)
4C — NuGet-relevant (realistische Einordnung)
dotnet nuget verify(Package Signatur prüfen)Deliverables (für Cluster 4)
docs/audit/004_CERTIFICATION_AND_ATTESTATION_ROADMAP.MDGate 4
Cluster 5 — Sichtbarkeit: Zertifikate/Attestations im Repo und im NuGet-Paket
Ziel: Die Nachweise sind sichtbar “auffindbar”, nicht nur in CI-Logs.
Repo-Sichtbarkeit (Pflicht)
docs/audit/000_INDEX.md(Verlinkung auf Scorecard, Attestations, Findings, Threat Model, etc.)NuGet-Paket-Sichtbarkeit (zielorientiert, technisch sauber)
RepositoryUrl,PackageProjectUrl,RepositoryType,PackageReadmeFile(NuGet)Gate 5
Cluster 6 — CodeQL Quality Hardening (C# build-mode: none fix)
Ziel: belastbare Code Scanning Ergebnisse, sonst ist “Security Evidence” unvollständig.
Deliverables
codeql.yml):build-mode: nonedotnet restore+dotnet buildpassend zur Solution/ProjectsGate 6
Cluster 7 — Vollständige Codeanalyse “vom Ablauf bis zur Codezeile” + Refactor-Backlog + Umsetzung
Ziel: Eine durchgezogene Analyse, die:
7A — Tooling (CI + lokal, installierbar)
Erlaubt sind installierbare Konsolen-Tools, wenn:
artifacts/audit/...)Deliverables
docs/audit/005_CODE_ANALYSIS_METHOD.MDartifacts/audit/code_inventory.csvartifacts/audit/callgraph_inventory.*(Format festlegen: JSON/CSV)artifacts/audit/dead_code_candidates.csvartifacts/audit/redundancy_candidates.csvartifacts/audit/hardening_candidates.csv7B — Findings (bis Codezeile)
docs/audit/006_CODE_REVIEW_FINDINGS.MD7C — Refactor-Umsetzung (priorisiert, evidenzbasiert)
Gate 7
Cluster 8 — Governance-Closure (Threat Model, Incident Response, Supply Chain Baseline)
Ziel: vollständige Betriebs- und Auditfähigkeit.
Deliverables
docs/audit/007_THREAT_MODEL.MDdocs/audit/008_INCIDENT_RESPONSE_RUNBOOK.MDdocs/audit/009_SUPPLY_CHAIN_BASELINE.MDGate 8
RISKS / Open Items / Mitigations (vollständig, priorisiert)
R1: “Zertifikat”-Wording kann irreführend sein (keine externe Auditstelle)
R2: GitHub API / Permissions / Rate Limits → nicht deterministische Checks
unknown+ klare ReasonR3: CodeQL C# Quality (build-mode none) erzeugt unzuverlässige Findings
R4: Scope-Explosion (SECURITY Claims + Audits + Deep Code Analysis)
R5: False Positives/Noise durch Tools (Scorecard/Qodana/Analyzers)
R6: Refactor-Risiko (Regressionen) bei großflächigem Hardening/Redundanzabbau
R7: NuGet Package “Zertifikate anzeigen” technisch missverständlich
R8: Externe Audits abhängig von Repo-Visibility (Scorecard für private Repos eingeschränkt)
Sichtbare Ergebnis-Outputs (Pflicht)
docs/audit/000_INDEX.mdals zentrale Startseitesecurity-claims-evidenceArtefakte je Run