Makes

Projects that follow the best practices below can voluntarily self-certify and show that they've achieved an Open Source Security Foundation (OpenSSF) best practices badge.

There is no set of practices that can guarantee that software will never have defects or vulnerabilities; even formal methods can fail if the specifications or assumptions are wrong. Nor is there any set of practices that can guarantee that a project will sustain a healthy and well-functioning development community. However, following best practices can help improve the results of projects. For example, some practices enable multi-person review before release, which can both help find otherwise hard-to-find technical vulnerabilities and help build trust and a desire for repeated interaction among developers from different companies. To earn a badge, all MUST and MUST NOT criteria must be met, all SHOULD criteria must be met OR be unmet with justification, and all SUGGESTED criteria must be met OR unmet (we want them considered at least). If you want to enter justification text as a generic comment, instead of being a rationale that the situation is acceptable, start the text block with '//' followed by a space. Feedback is welcome via the GitHub site as issues or pull requests There is also a mailing list for general discussion.

We gladly provide the information in several locales, however, if there is any conflict or inconsistency between the translations, the English version is the authoritative version.

If this is your project, please show your badge status on your project page! The badge status looks like this:

Here is how to embed it:

You can show your badge status by embedding this in your markdown file:

[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/5703/badge)](https://www.bestpractices.dev/projects/5703)

or by embedding this in your HTML:
<a href="https://www.bestpractices.dev/projects/5703"><img src="https://www.bestpractices.dev/projects/5703/badge"></a>

These are the

level criteria. You can also view the

level criteria.

Basics 5/5 ●

Identification

What is the human-readable name of the project?
Note that other projects may use the same name.

What is a brief description of the project?

A DevSecOps framework powered by Nix.

What is the URL for the project (as a whole)?
https://github.com/fluidattacks/makes

What is the URL for the version control repository (it may be the same as the project URL)?
https://github.com/fluidattacks/makes
Prerequisites

Criterion [achieve_silver]
Met

Unmet

The project MUST achieve a silver level badge. ^{[achieve_silver]}
Project oversight

Criterion [bus_factor]
Met

Unmet

?

Mradi LAZIMA uwe na "bus factor" ya 2 au zaidi. (URL required) ^[bus_factor]
A "bus factor" (aka "truck factor") is the minimum number of project members that have to suddenly disappear from a project ("hit by a bus") before the project stalls due to lack of knowledgeable or competent personnel. The truck-factor tool can estimate this for projects on GitHub. For more information, see Assessing the Bus Factor of Git Repositories by Cosentino et al.

The project is maintained by Fluid Attacks and employes contribute to it as part of of their work schedule. Usually more than 2 developers contribute to each release: https://github.com/fluidattacks/makes/commits/main and currently we have three persons in the payroll with maintainer status: https://fluidattacks.github.io/makes/governance/
Criterion [contributors_unassociated]
Met

Unmet

?

Mradi LAZIMA uwe na angalau wachangiaji wawili wasiohusika. (URL required) ^{[contributors_unassociated]}
Contributors are associated if they are paid to work by the same organization (as an employee or contractor) and the organization stands to benefit from the project's results. Financial grants do not count as being from the same organization if they pass through other organizations (e.g., science grants paid to different organizations from a common government or NGO source do not cause contributors to be associated). Someone is a significant contributor if they have made non-trivial contributions to the project in the past year. Examples of good indicators of a significant contributor are: written at least 1,000 lines of code, contributed 50 commits, or contributed at least 20 pages of documentation.
As of 2022-09-22, the project has had code contributions (measured in commits) from the following individuals:

makes $ git log --format=%aN --since=2021-09-22 | sort | uniq -c | sort -rn
```
152 Kevin Amado
109 John Perez
 49 Daniel Salazar
 15 Diego Restrepo
  6 David Arnold
  3 Luis Saavedra
  2 GuangTao Zhang
  1 Timothy DeHerrera
  1 Github Dependabot
  1 Daniel Murcia
```
https://github.com/fluidattacks/makes/commits/main
Other

Criterion [copyright_per_file]
Met

Unmet

?

The project MUST include a copyright statement in each source file, identifying the copyright holder (e.g., the [project name] contributors). ^{[copyright_per_file]}
This MAY be done by including the following inside a comment near the beginning of each file: "Copyright the [project name] contributors.". See "Copyright Notices in Open Source Software Projects" by Steve Winslow.

We use https://reuse.software/ and validate its compliance in the CI/CD on each pull request. This is how a file copyright statement looks like: https://github.com/fluidattacks/makes/blob/cf3762cd96b65759d9c18a9b30f41d5aac465f2c/README.md?plain=1#L1-L5

Criterion [license_per_file]
Met

Unmet

?

The project MUST include a license statement in each source file. This MAY be done by including the following inside a comment near the beginning of each file: SPDX-License-Identifier: [SPDX license expression for project]. ^{[license_per_file]}
This MAY also be done by including a statement in natural language identifying the license. The project MAY also include a stable URL pointing to the license text, or the full license text. Note that the criterion license_location requires the project license be in a standard location. See this SPDX tutorial for more information about SPDX license expressions. Note the relationship with copyright_per_file, whose content would typically precede the license information.

We use https://reuse.software/ and validate its compliance in the CI/CD on each pull request. This is how a file copyright statement looks like: https://github.com/fluidattacks/makes/blob/cf3762cd96b65759d9c18a9b30f41d5aac465f2c/README.md?plain=1#L1-L5

Analysis 2/2 ●

Dynamic code analysis

Criterion [dynamic_analysis]
Met

Unmet

N/A

?

The project MUST apply at least one dynamic analysis tool to any proposed major production release of the software produced by the project before its release. ^{[dynamic_analysis]}
A dynamic analysis tool examines the software by executing it with specific inputs. For example, the project MAY use a fuzzing tool (e.g., American Fuzzy Lop) or a web application scanner (e.g., OWASP ZAP or w3af). In some cases the OSS-Fuzz project may be willing to apply fuzz testing to your project. For purposes of this criterion the dynamic analysis tool needs to vary the inputs in some way to look for various kinds of problems or be an automated test suite with at least 80% branch coverage. The Wikipedia page on dynamic analysis and the OWASP page on fuzzing identify some dynamic analysis tools. The analysis tool(s) MAY be focused on looking for security vulnerabilities, but this is not required.

We use an automated test suite for this purpose, branch coverage is enabled on it, and the critical flows are tested and verified by the CI/CD system for every change made in the project

Criterion [dynamic_analysis_enable_assertions]
Met

Unmet

N/A

?

The project SHOULD include many run-time assertions in the software it produces and check those assertions during dynamic analysis. ^{[dynamic_analysis_enable_assertions]}
This criterion does not suggest enabling assertions during production; that is entirely up to the project and its users to decide. This criterion's focus is instead to improve fault detection during dynamic analysis before deployment. Enabling assertions in production use is completely different from enabling assertions during dynamic analysis (such as testing). In some cases enabling assertions in production use is extremely unwise (especially in high-integrity components). There are many arguments against enabling assertions in production, e.g., libraries should not crash callers, their presence may cause rejection by app stores, and/or activating an assertion in production may expose private data such as private keys. Beware that in many Linux distributions NDEBUG is not defined, so C/C++ assert() will by default be enabled for production in those environments. It may be important to use a different assertion mechanism or defining NDEBUG for production in those environments.

We use raise SystemExit(code) anytime an error condition is encountered so that the CLI signals to the user that something went wrong. An error message is also normally printed. This system exits would also be caught by the dynamic analysis tool.

This data is available under the Creative Commons Attribution version 3.0 or later license (CC-BY-3.0+). All are free to share and adapt the data, but must give appropriate credit. Please credit John Perez and the OpenSSF Best Practices badge contributors.

Makes

Basics 5/5 ●

Identification

Prerequisites

Project oversight

Other

Change Control 4/4 ●

Public version-controlled source repository

Quality 7/7 ●

Coding standards

Working build system

Automated test suite

Security 5/5 ●

Use basic good cryptographic practices

Secured delivery against man-in-the-middle (MITM) attacks

Other security issues

Analysis 2/2 ●

Dynamic code analysis