Create Supplemental Material for deeper dives and clarification
adriandiglio opened this issue · 2 comments
adriandiglio commented
Definition of Supplemental Material: A 1-2 page write up to provide clarification on certain scenarios.
Example list of initial Supplemental Guides:
- How S2C2F applies to C/C++ OSS
- How OSS consumers SHOULD use metadata (i.e. OSS Scorecard) to make their own risk-based policies for consumption
- How S2C2F applies to Linux rpm/deb packages
- How to securely configure package source files for ENF-1
- Elaborate on validating provenance (AUD-1), to include validating SLSA provenance
jasminewang0 commented
Another supplemental guide example that came up was one about branch protections and approvals
joshuagl commented
It would be great to see some supplemental guidance around AUD-5 / Validate the author of your OSS.