From 77c9a7f477e16bb9f7827ecee13926ebc14847b0 Mon Sep 17 00:00:00 2001 From: Satarupa22-SD Date: Fri, 28 Aug 2026 21:30:53 +0530 Subject: [PATCH 1/3] Remove While active qualifier from baseline Signed-off-by: Satarupa22-SD --- baseline/OSPS-GV.yaml | 18 +++++++++--------- baseline/OSPS-LE.yaml | 10 +++++----- baseline/OSPS-QA.yaml | 10 +++++----- baseline/OSPS-VM.yaml | 20 ++++++++++---------- 4 files changed, 29 insertions(+), 29 deletions(-) diff --git a/baseline/OSPS-GV.yaml b/baseline/OSPS-GV.yaml index 04cd2e9f..ae71fa6e 100644 --- a/baseline/OSPS-GV.yaml +++ b/baseline/OSPS-GV.yaml @@ -19,8 +19,8 @@ controls: assessment-requirements: - id: OSPS-GV-01.01 text: | - While active, the project documentation MUST include a list of - project members with access to sensitive resources. + The project documentation MUST include a list of project members with + access to sensitive resources applicability: - maturity-2 - maturity-3 @@ -32,8 +32,8 @@ controls: of maintainers, or more complex depending on the project's governance. - id: OSPS-GV-01.02 text: | - While active, the project documentation MUST include descriptions of - the roles and responsibilities for members of the project. + The project documentation MUST include descriptions of the roles and + responsibilities for members of the project applicability: - maturity-2 - maturity-3 @@ -53,7 +53,7 @@ controls: assessment-requirements: - id: OSPS-GV-02.01 text: | - While active, the project MUST have one or more mechanisms for public + The project MUST have one or more mechanisms for public discussions about proposed changes and usage obstacles. applicability: - maturity-1 @@ -74,8 +74,8 @@ controls: assessment-requirements: - id: OSPS-GV-03.01 text: | - While active, the project documentation MUST include an explanation - of the contribution process. + The project documentation MUST include an explanation of the + contribution process, or clearly state that public contributions are not accepted applicability: - maturity-1 - maturity-2 @@ -86,7 +86,7 @@ controls: engaging with the project maintainers. - id: OSPS-GV-03.02 text: | - While active, the project documentation MUST include a guide for code + The project documentation MUST include a guide for code contributors that includes requirements for acceptable contributions. applicability: - maturity-2 @@ -109,7 +109,7 @@ controls: assessment-requirements: - id: OSPS-GV-04.01 text: | - While active, the project documentation MUST have a policy that code + The project documentation MUST have a policy that code collaborators are reviewed prior to granting escalated permissions to sensitive resources. applicability: diff --git a/baseline/OSPS-LE.yaml b/baseline/OSPS-LE.yaml index e0c557a0..e8abc1d8 100644 --- a/baseline/OSPS-LE.yaml +++ b/baseline/OSPS-LE.yaml @@ -22,7 +22,7 @@ controls: assessment-requirements: - id: OSPS-LE-01.01 text: | - While active, the version control system MUST require all code + Theversion control system MUST require all code contributors to assert that they are legally authorized to make the associated contributions on every commit. applicability: @@ -51,7 +51,7 @@ controls: assessment-requirements: - id: OSPS-LE-02.01 text: | - While active, the license for the source code MUST meet the OSI Open + The license for the source code MUST meet the OSI Open Source Definition or the FSF Free Software Definition. applicability: - maturity-1 @@ -67,7 +67,7 @@ controls: this control if there are no other encumbrances such as patents. - id: OSPS-LE-02.02 text: | - While active, the license for the released software assets MUST meet + The license for the released software assets MUST meet the OSI Open Source Definition or the FSF Free Software Definition. applicability: - maturity-1 @@ -93,7 +93,7 @@ controls: assessment-requirements: - id: OSPS-LE-03.01 text: | - While active, the license for the source code MUST be maintained in + The license for the source code MUST be maintained in the corresponding repository's LICENSE file, COPYING file, LICENSES/ directory, or LICENSE/ directory. applicability: @@ -109,7 +109,7 @@ controls: includes the license file. - id: OSPS-LE-03.02 text: | - While active, the license for the released software assets MUST be + The license for the released software assets MUST be included in the released source code, or in a LICENSE file, COPYING file, or LICENSE/ directory alongside the corresponding release assets. diff --git a/baseline/OSPS-QA.yaml b/baseline/OSPS-QA.yaml index 472dc1c5..e958a6e9 100644 --- a/baseline/OSPS-QA.yaml +++ b/baseline/OSPS-QA.yaml @@ -21,7 +21,7 @@ controls: assessment-requirements: - id: OSPS-QA-01.01 text: | - While active, the project's source code repository MUST be publicly + The project's source code repository MUST be publicly readable at a static URL. applicability: - maturity-1 @@ -152,7 +152,7 @@ controls: assessment-requirements: - id: OSPS-QA-05.01 text: | - While active, the version control system MUST NOT contain generated + The version control system MUST NOT contain generated executable artifacts. applicability: - maturity-1 @@ -166,7 +166,7 @@ controls: fetched during a specific well-documented pipeline step. - id: OSPS-QA-05.02 text: | - While active, the version control system MUST NOT contain unreviewable + The version control system MUST NOT contain unreviewable binary artifacts. applicability: - maturity-1 @@ -205,7 +205,7 @@ controls: end-to-end tests. - id: OSPS-QA-06.02 text: | - While active, project's documentation MUST clearly document when and + The project's documentation MUST clearly document when and how tests are run. applicability: - maturity-3 @@ -216,7 +216,7 @@ controls: interpret the results. - id: OSPS-QA-06.03 text: | - While active, the project's documentation MUST include a policy that + The project's documentation MUST include a policy that all major changes to the software produced by the project should add or update tests of the functionality in an automated test suite. applicability: diff --git a/baseline/OSPS-VM.yaml b/baseline/OSPS-VM.yaml index 6a705196..b12969d6 100644 --- a/baseline/OSPS-VM.yaml +++ b/baseline/OSPS-VM.yaml @@ -20,7 +20,7 @@ controls: assessment-requirements: - id: OSPS-VM-01.01 text: | - While active, the project documentation MUST + The project documentation MUST include a policy for coordinated vulnerability disclosure (CVD), with a clear timeframe for response. applicability: @@ -43,7 +43,7 @@ controls: assessment-requirements: - id: OSPS-VM-02.01 text: | - While active, the project documentation MUST contain + The project documentation MUST contain security contacts. applicability: - maturity-1 @@ -63,7 +63,7 @@ controls: assessment-requirements: - id: OSPS-VM-03.01 text: | - While active, the project documentation MUST + The project documentation MUST provide a means for private vulnerability reporting directly to the security contacts within the project. applicability: @@ -85,7 +85,7 @@ controls: assessment-requirements: - id: OSPS-VM-04.01 text: | - While active, the project documentation MUST + The project documentation MUST publicly publish data about discovered vulnerabilities. applicability: - maturity-2 @@ -98,7 +98,7 @@ controls: instructions for mitigation or remediation. - id: OSPS-VM-04.02 text: | - While active, any vulnerabilities in the + Any vulnerabilities in the software components not affecting the project MUST be accounted for in a VEX document, augmenting the vulnerability report with non-exploitability details. @@ -121,7 +121,7 @@ controls: assessment-requirements: - id: OSPS-VM-05.01 text: | - While active, the project documentation MUST include a policy that + The project documentation MUST include a policy that defines a threshold for remediation of SCA findings related to vulnerabilities and licenses. applicability: @@ -133,7 +133,7 @@ controls: these findings. - id: OSPS-VM-05.02 text: | - While active, the project documentation MUST include a policy to + The project documentation MUST include a policy to address SCA violations prior to any release. applicability: - maturity-3 @@ -143,7 +143,7 @@ controls: that verify compliance with that policy prior to release. - id: OSPS-VM-05.03 text: | - While active, all changes to the project's codebase MUST be + All changes to the project's codebase MUST be automatically evaluated against a documented policy for malicious dependencies and known vulnerabilities in dependencies, then blocked in the event of violations, except when declared and suppressed as @@ -167,7 +167,7 @@ controls: assessment-requirements: - id: OSPS-VM-06.01 text: | - While active, the project documentation MUST include a policy that + The project documentation MUST include a policy that defines a threshold for remediation of SAST findings. applicability: - maturity-3 @@ -178,7 +178,7 @@ controls: these findings. - id: OSPS-VM-06.02 text: | - While active, all changes to the project's codebase MUST be + All changes to the project's codebase MUST be automatically evaluated against a documented policy for security weaknesses and blocked in the event of violations except when declared and suppressed as non-exploitable. From 395f89e196b801e3540998599263d8b701533aae Mon Sep 17 00:00:00 2001 From: Satarupa22-SD Date: Fri, 28 Aug 2026 21:36:56 +0530 Subject: [PATCH 2/3] fix typo Signed-off-by: Satarupa22-SD --- baseline/OSPS-LE.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/baseline/OSPS-LE.yaml b/baseline/OSPS-LE.yaml index e8abc1d8..18e0357e 100644 --- a/baseline/OSPS-LE.yaml +++ b/baseline/OSPS-LE.yaml @@ -22,7 +22,7 @@ controls: assessment-requirements: - id: OSPS-LE-01.01 text: | - Theversion control system MUST require all code + The version control system MUST require all code contributors to assert that they are legally authorized to make the associated contributions on every commit. applicability: From 4b5ca4c0ca558aa548949a8c964d519e085da8f2 Mon Sep 17 00:00:00 2001 From: Satarupa22-SD Date: Fri, 28 Aug 2026 22:32:01 +0530 Subject: [PATCH 3/3] add period Signed-off-by: Satarupa22-SD --- baseline/OSPS-GV.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/baseline/OSPS-GV.yaml b/baseline/OSPS-GV.yaml index ae71fa6e..4bbbb7f8 100644 --- a/baseline/OSPS-GV.yaml +++ b/baseline/OSPS-GV.yaml @@ -20,7 +20,7 @@ controls: - id: OSPS-GV-01.01 text: | The project documentation MUST include a list of project members with - access to sensitive resources + access to sensitive resources. applicability: - maturity-2 - maturity-3