CoreDNS Project Security Self-Assessment - Security Pals #1189

TomY-Zhang · 2023-12-07T01:14:15Z

Created and added first draft for CoreDNS Project Security Self-Assessment.
Please feel free to share your feedback on the security self-assessment.

Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com>

Co-Authored-By: maryammohagheghi <43008809+maryammohagheghi@users.noreply.github.com> Co-Authored-By: Rohit Chaudhari <46722995+rsc1102@users.noreply.github.com> Co-Authored-By: Vamshi-Madineni <129896345+vamshi-madineni@users.noreply.github.com>

netlify · 2023-12-07T01:14:21Z

✅ Deploy Preview for tag-security ready!

Name	Link
🔨 Latest commit	`9043b2b`
🔍 Latest deploy log	https://app.netlify.com/sites/tag-security/deploys/65b16004b60ce100080f7105
😎 Deploy Preview	https://deploy-preview-1189--tag-security.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

eddie-knight · 2023-12-08T15:56:19Z

Hi there, and thanks for your work on this self assessment!

I noticed that you included an SBOM along with the self assessment. There are two reasons that jump to the front of my mind for why this isn't needed...

SBOMs should be associated with releases, as the bill of materials is only accurate and useful if it is created at build time and associated to a particular point in the code history.
If you need to link to an SBOM for some reason in the self-assessment, you can just provide a link out to the latest build artifacts that contain an SBOM.

We still have plenty more to review, but as a starter— could you please remove the SBOM from this PR?

Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com>

TomY-Zhang · 2023-12-09T23:58:29Z

Hi @eddie-knight,

I removed the SBOM from the self-assessment. We do need a SBOM, but unfortunately, there isn't any SBOM released with each release of the project.

ragashreeshekar

Thanks for the PR @TomY-Zhang and team, appreciate the efforts.
I have completed first pass of review. Please feel free to reach out here or on slack for any questions and clarifications.

Along with addressing the comments, kindly update the PR branch with the latest content in the repo as this branch is out-of-date with the base branch.

assessments/projects/coredns/self-assessment.md

Signed-off-by: Rohit Chaudhari <46722995+rsc1102@users.noreply.github.com>

Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com>

Signed-off-by: Rohit Chaudhari <46722995+rsc1102@users.noreply.github.com>

…s section Signed-off-by: Rohit Chaudhari <46722995+rsc1102@users.noreply.github.com>

Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com>

rsc1102 · 2023-12-11T19:56:02Z

Hi @ragashreeshekar,
Thank you for your suggestions. We have made the necessary changes.
Please review our self-assessment so that we can finalize the document.

assessments/projects/coredns/self-assessment.md

Co-authored-by: Eddie Knight <iv.eddieknight@gmail.com> Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com>

Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com>

assessments/projects/coredns/self-assessment.md

Co-authored-by: Eddie Knight <iv.eddieknight@gmail.com> Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com>

Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com>

TomY-Zhang · 2023-12-12T18:14:45Z

Hi @eddie-knight ,

I have modified the assessment in accordance to your suggestions.

assessments/projects/coredns/self-assessment.md

Co-authored-by: torinvdb <65670557+torinvdb@users.noreply.github.com> Signed-off-by: Rohit Chaudhari <46722995+rsc1102@users.noreply.github.com>

rsc1102 · 2024-01-19T18:26:56Z

@torinvdb @ragashreeshekar the suggestions have been commited.

JustinCappos · 2024-01-24T16:01:44Z

@ragashreeshekar Can you update your review please?

JustinCappos

I approve. Looks good from my standpoint.

* Create coredns_sbom.json Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Add files via upload Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Update self-assessment.md Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Update formatting Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Update compliance Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Update header Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Fixed errors in accordance to feedback from project maintainers Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Delete assessments/projects/coredns/coredns_sbom.json Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Update SBOM Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Fixed heading Signed-off-by: Rohit Chaudhari <46722995+rsc1102@users.noreply.github.com> * Added links to SECURITY.md and mailing lists Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Fixed section heading tags Signed-off-by: Rohit Chaudhari <46722995+rsc1102@users.noreply.github.com> * Removed "Security Incident Response" from secure development practices section Signed-off-by: Rohit Chaudhari <46722995+rsc1102@users.noreply.github.com> * Update formatting Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Re-added 'Compliance and Standards' Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Specified that CoreDNS does not generate SBOM in 'Metadata' section Co-authored-by: Eddie Knight <iv.eddieknight@gmail.com> Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Updated 'Self-assessment use' section Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Added "CoreDNS Plugins" to Actors Co-authored-by: Eddie Knight <iv.eddieknight@gmail.com> Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Updated "Actions" and added "Documentation" section Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Fixed typo Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Update assessments/projects/coredns/self-assessment.md Co-authored-by: torinvdb <65670557+torinvdb@users.noreply.github.com> Signed-off-by: Rohit Chaudhari <46722995+rsc1102@users.noreply.github.com> * Update assessments/projects/coredns/self-assessment.md Co-authored-by: torinvdb <65670557+torinvdb@users.noreply.github.com> Signed-off-by: Rohit Chaudhari <46722995+rsc1102@users.noreply.github.com> --------- Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> Signed-off-by: Rohit Chaudhari <46722995+rsc1102@users.noreply.github.com> Co-authored-by: maryammohagheghi <43008809+maryammohagheghi@users.noreply.github.com> Co-authored-by: Rohit Chaudhari <46722995+rsc1102@users.noreply.github.com> Co-authored-by: Vamshi-Madineni <129896345+vamshi-madineni@users.noreply.github.com> Co-authored-by: Eddie Knight <iv.eddieknight@gmail.com> Co-authored-by: torinvdb <65670557+torinvdb@users.noreply.github.com> Signed-off-by: Mariusz Sabath <mrsabath@gmail.com>

* Create coredns_sbom.json Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Add files via upload Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Update self-assessment.md Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Update formatting Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Update compliance Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Update header Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Fixed errors in accordance to feedback from project maintainers Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Delete assessments/projects/coredns/coredns_sbom.json Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Update SBOM Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Fixed heading Signed-off-by: Rohit Chaudhari <46722995+rsc1102@users.noreply.github.com> * Added links to SECURITY.md and mailing lists Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Fixed section heading tags Signed-off-by: Rohit Chaudhari <46722995+rsc1102@users.noreply.github.com> * Removed "Security Incident Response" from secure development practices section Signed-off-by: Rohit Chaudhari <46722995+rsc1102@users.noreply.github.com> * Update formatting Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Re-added 'Compliance and Standards' Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Specified that CoreDNS does not generate SBOM in 'Metadata' section Co-authored-by: Eddie Knight <iv.eddieknight@gmail.com> Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Updated 'Self-assessment use' section Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Added "CoreDNS Plugins" to Actors Co-authored-by: Eddie Knight <iv.eddieknight@gmail.com> Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Updated "Actions" and added "Documentation" section Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Fixed typo Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> * Update assessments/projects/coredns/self-assessment.md Co-authored-by: torinvdb <65670557+torinvdb@users.noreply.github.com> Signed-off-by: Rohit Chaudhari <46722995+rsc1102@users.noreply.github.com> * Update assessments/projects/coredns/self-assessment.md Co-authored-by: torinvdb <65670557+torinvdb@users.noreply.github.com> Signed-off-by: Rohit Chaudhari <46722995+rsc1102@users.noreply.github.com> --------- Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com> Signed-off-by: Rohit Chaudhari <46722995+rsc1102@users.noreply.github.com> Co-authored-by: maryammohagheghi <43008809+maryammohagheghi@users.noreply.github.com> Co-authored-by: Rohit Chaudhari <46722995+rsc1102@users.noreply.github.com> Co-authored-by: Vamshi-Madineni <129896345+vamshi-madineni@users.noreply.github.com> Co-authored-by: Eddie Knight <iv.eddieknight@gmail.com> Co-authored-by: torinvdb <65670557+torinvdb@users.noreply.github.com> Signed-off-by: Andres Vega <av@monkey.org>

TomY-Zhang and others added 8 commits December 3, 2023 15:38

Create coredns_sbom.json

48a350a

Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com>

Add files via upload

e1a9ff2

Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com>

Update self-assessment.md

a9cc4ea

Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com>

Update formatting

27c056e

Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com>

Update compliance

e422422

Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com>

Update header

8d582fa

Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com>

Fixed errors in accordance to feedback from project maintainers

874c505

Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com>

Merge branch 'cncf:main' into main

4ea1950

Co-Authored-By: maryammohagheghi <43008809+maryammohagheghi@users.noreply.github.com> Co-Authored-By: Rohit Chaudhari <46722995+rsc1102@users.noreply.github.com> Co-Authored-By: Vamshi-Madineni <129896345+vamshi-madineni@users.noreply.github.com>

github-actions bot requested review from achetal01, dshaw and sublimino December 7, 2023 01:14

TomY-Zhang added 2 commits December 8, 2023 17:52

Delete assessments/projects/coredns/coredns_sbom.json

be93f62

Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com>

Update SBOM

8c1c718

Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com>

ragashreeshekar suggested changes Dec 10, 2023

View reviewed changes

TomY-Zhang and others added 7 commits December 10, 2023 14:36

Merge branch 'cncf:main' into main

74fd240

Fixed heading

7a7bbf4

Signed-off-by: Rohit Chaudhari <46722995+rsc1102@users.noreply.github.com>

Added links to SECURITY.md and mailing lists

7463522

Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com>

Fixed section heading tags

6efdfc4

Signed-off-by: Rohit Chaudhari <46722995+rsc1102@users.noreply.github.com>

Removed "Security Incident Response" from secure development practice…

8b8fc5c

…s section Signed-off-by: Rohit Chaudhari <46722995+rsc1102@users.noreply.github.com>

Update formatting

174ca75

Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com>

Re-added 'Compliance and Standards'

98040da

Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com>

eddie-knight reviewed Dec 12, 2023

View reviewed changes

assessments/projects/coredns/self-assessment.md Outdated Show resolved Hide resolved

eddie-knight reviewed Dec 12, 2023

View reviewed changes

assessments/projects/coredns/self-assessment.md Show resolved Hide resolved

TomY-Zhang and others added 2 commits December 12, 2023 11:08

Specified that CoreDNS does not generate SBOM in 'Metadata' section

94b0270

Co-authored-by: Eddie Knight <iv.eddieknight@gmail.com> Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com>

Updated 'Self-assessment use' section

0082b11

Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com>

eddie-knight reviewed Dec 12, 2023

View reviewed changes

assessments/projects/coredns/self-assessment.md Outdated Show resolved Hide resolved

assessments/projects/coredns/self-assessment.md Outdated Show resolved Hide resolved

TomY-Zhang and others added 3 commits December 12, 2023 12:37

Added "CoreDNS Plugins" to Actors

f9285ad

Co-authored-by: Eddie Knight <iv.eddieknight@gmail.com> Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com>

Updated "Actions" and added "Documentation" section

8af3a87

Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com>

Fixed typo

76c210e

Signed-off-by: Tom Zhang <87039997+TomY-Zhang@users.noreply.github.com>

torinvdb reviewed Jan 16, 2024

View reviewed changes

assessments/projects/coredns/self-assessment.md Outdated Show resolved Hide resolved

torinvdb reviewed Jan 16, 2024

View reviewed changes

assessments/projects/coredns/self-assessment.md Outdated Show resolved Hide resolved

rsc1102 and others added 2 commits January 19, 2024 13:24

Update assessments/projects/coredns/self-assessment.md

191912b

Co-authored-by: torinvdb <65670557+torinvdb@users.noreply.github.com> Signed-off-by: Rohit Chaudhari <46722995+rsc1102@users.noreply.github.com>

Update assessments/projects/coredns/self-assessment.md

3a4fefe

Co-authored-by: torinvdb <65670557+torinvdb@users.noreply.github.com> Signed-off-by: Rohit Chaudhari <46722995+rsc1102@users.noreply.github.com>

JustinCappos approved these changes Jan 24, 2024

View reviewed changes

Merge branch 'main' into main

9043b2b

eddie-knight approved these changes Jan 24, 2024

View reviewed changes

ragashreeshekar approved these changes Jan 24, 2024

View reviewed changes

ragashreeshekar merged commit da7ae76 into cncf:main Jan 24, 2024
9 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CoreDNS Project Security Self-Assessment - Security Pals #1189

CoreDNS Project Security Self-Assessment - Security Pals #1189

TomY-Zhang commented Dec 7, 2023

netlify bot commented Dec 7, 2023 •

edited

Loading

eddie-knight commented Dec 8, 2023

TomY-Zhang commented Dec 9, 2023

ragashreeshekar left a comment

rsc1102 commented Dec 11, 2023

TomY-Zhang commented Dec 12, 2023

rsc1102 commented Jan 19, 2024

JustinCappos commented Jan 24, 2024

JustinCappos left a comment

CoreDNS Project Security Self-Assessment - Security Pals #1189

CoreDNS Project Security Self-Assessment - Security Pals #1189

Conversation

TomY-Zhang commented Dec 7, 2023

netlify bot commented Dec 7, 2023 • edited Loading

✅ Deploy Preview for tag-security ready!

eddie-knight commented Dec 8, 2023

TomY-Zhang commented Dec 9, 2023

ragashreeshekar left a comment

Choose a reason for hiding this comment

rsc1102 commented Dec 11, 2023

TomY-Zhang commented Dec 12, 2023

rsc1102 commented Jan 19, 2024

JustinCappos commented Jan 24, 2024

JustinCappos left a comment

Choose a reason for hiding this comment

netlify bot commented Dec 7, 2023 •

edited

Loading