1metadata:
2 id: PVTR-BASELINE-SCAN
3 type: EvaluationLog
4 gemara-version: "1.1.0"
5 version: 1.0.0
6 description: PVTR baseline scan evaluation results
7 author:
8 id: pvtr
9 name: PVTR
10 type: Software
11 mapping-references:
12 - id: github-api
13 title: "GitHub REST API"
14 version: "2025"
15 url: "https://api.github.com"
16result: Failed
17target:
18 id: github-repo
19 name: GitHub Repository
20 type: Software
21evaluations:
22- name: ''
23 assessment-logs:
24 - requirement:
25 entry-id: OSPS-AC-01.01
26 applicability:
27 - Maturity Level 1
28 - Maturity Level 2
29 - Maturity Level 3
30 steps:
31 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/access_control.orgRequiresMFA
32 description: When a user attempts to access a sensitive resource in the project's
33 version control system, the system MUST require the user to complete a multi-factor
34 authentication process.
35 result: Passed
36 message: Two-factor authentication is configured as required by the parent organization
37 steps-executed: 1
38 start: 2025-08-22T16:02:00.000000000Z
39 end: 2025-08-22T16:02:00.000003708Z
40 evidence:
41 - id: EV-AC-01-01
42 type: api-response
43 collected-at: 2025-08-22T16:02:00.000003000Z
44 source:
45 reference-id: github-api
46 coordinate: "/orgs/revanite-io/settings"
47 digest: "sha256:b3c4d5e6f7a8901bcdef234567890abcdef1234567890abcdef1234567890ab12"
48 payload:
49 login: revanite-io
50 two_factor_requirement_enabled: true
51 description: Organization settings showing org-wide MFA enforcement
52 control:
53 reference-id: OSPS-B
54 entry-id: OSPS-AC-01
55 result: Passed
56 message: Two-factor authentication is configured as required by the parent organization
57- name: ''
58 assessment-logs:
59 - requirement:
60 entry-id: OSPS-AC-02.01
61 applicability:
62 - Maturity Level 1
63 - Maturity Level 2
64 - Maturity Level 3
65 steps:
66 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.GithubBuiltIn
67 description: When a new collaborator is added, the version control system MUST
68 require manual permission assignment, or restrict the collaborator permissions
69 to the lowest available privileges by default.
70 result: Passed
71 message: This control is enforced by GitHub for all projects
72 steps-executed: 1
73 start: 2025-08-22T16:02:00.000000000Z
74 end: 2025-08-22T16:02:00.000001208Z
75 control:
76 reference-id: OSPS-B
77 entry-id: OSPS-AC-02
78 result: Passed
79 message: This control is enforced by GitHub for all projects
80- name: ''
81 assessment-logs:
82 - requirement:
83 entry-id: OSPS-AC-03.01
84 applicability:
85 - Maturity Level 1
86 - Maturity Level 2
87 - Maturity Level 3
88 steps:
89 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.IsCodeRepo
90 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/access_control.branchProtectionRestrictsPushes
91 description: When a direct commit is attempted on the project's primary branch,
92 an enforcement mechanism MUST prevent the change from being applied.
93 result: Passed
94 message: Branch protection rule requires approving reviews
95 steps-executed: 2
96 start: 2025-08-22T16:02:00.000000000Z
97 end: 2025-08-22T16:02:00.000002750Z
98 - requirement:
99 entry-id: OSPS-AC-03.02
100 applicability:
101 - Maturity Level 1
102 - Maturity Level 2
103 - Maturity Level 3
104 steps:
105 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/access_control.branchProtectionPreventsDeletion
106 description: When an attempt is made to delete the project's primary branch, the
107 version control system MUST treat this as a sensitive activity and require explicit
108 confirmation of intent.
109 result: Passed
110 message: Branch protection rule prevents deletions
111 steps-executed: 1
112 start: 2025-08-22T16:02:00.000000000Z
113 end: 2025-08-22T16:02:00.000001167Z
114 control:
115 reference-id: OSPS-B
116 entry-id: OSPS-AC-03
117 result: Passed
118 message: Branch protection rule prevents deletions
119- name: ''
120 assessment-logs:
121 - requirement:
122 entry-id: OSPS-AC-04.01
123 applicability:
124 - Maturity Level 2
125 - Maturity Level 3
126 steps:
127 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/access_control.workflowDefaultReadPermissions
128 description: When a CI/CD task is executed with no permissions specified, the
129 project's version control system MUST default to the lowest available permissions
130 for all activities in the pipeline.
131 result: Not Run
132 message: '""'
133 steps-executed: 0
134 start: 2025-08-22T16:02:00.000000000Z
135 control:
136 reference-id: OSPS-B
137 entry-id: OSPS-AC-04
138 result: Not Run
139 message: '""'
140- name: ''
141 assessment-logs:
142 - requirement:
143 entry-id: OSPS-BR-01.01
144 applicability:
145 - Maturity Level 1
146 - Maturity Level 2
147 - Maturity Level 3
148 steps:
149 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.IsCodeRepo
150 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/build_release.cicdSanitizedInputParameters
151 description: When a CI/CD pipeline accepts an input parameter, that parameter
152 MUST be sanitized and validated prior to use in the pipeline.
153 result: Passed
154 message: GitHub Workflows variables do not contain untrusted inputs
155 steps-executed: 2
156 start: 2025-08-22T16:02:00.000000000Z
157 end: 2025-08-22T16:02:01.711621250Z
158 - requirement:
159 entry-id: OSPS-BR-01.02
160 applicability:
161 - Maturity Level 1
162 - Maturity Level 2
163 - Maturity Level 3
164 steps:
165 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.NotImplemented
166 description: When a CI/CD pipeline uses a branch name in its functionality, that
167 name value MUST be sanitized and validated prior to use in the pipeline.
168 result: Needs Review
169 message: Not implemented
170 steps-executed: 1
171 start: 2025-08-22T16:02:00.000000000Z
172 end: 2025-08-22T16:02:00.000000708Z
173 control:
174 reference-id: OSPS-B
175 entry-id: OSPS-BR-01
176 result: Needs Review
177 message: Not implemented
178- name: ''
179 assessment-logs:
180 - requirement:
181 entry-id: OSPS-BR-02.01
182 applicability:
183 - Maturity Level 2
184 - Maturity Level 3
185 steps:
186 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.HasMadeReleases
187 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/build_release.releaseHasUniqueIdentifier
188 description: When an official release is created, that release MUST be assigned
189 a unique version identifier.
190 result: Not Run
191 message: '""'
192 steps-executed: 0
193 start: 2025-08-22T16:02:00.000000000Z
194 control:
195 reference-id: OSPS-B
196 entry-id: OSPS-BR-02
197 result: Not Run
198 message: '""'
199- name: ''
200 assessment-logs:
201 - requirement:
202 entry-id: OSPS-BR-03.01
203 applicability:
204 - Maturity Level 1
205 - Maturity Level 2
206 - Maturity Level 3
207 steps:
208 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.HasSecurityInsightsFile
209 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/build_release.ensureInsightsLinksUseHTTPS
210 description: When the project lists a URI as an official project channel, that
211 URI MUST be exclusively delivered using encrypted channels.
212 result: Needs Review
213 message: All links use HTTPS
214 steps-executed: 2
215 start: 2025-08-22T16:02:00.000000000Z
216 end: 2025-08-22T16:02:00.000003417Z
217 - requirement:
218 entry-id: OSPS-BR-03.02
219 applicability:
220 - Maturity Level 1
221 - Maturity Level 2
222 - Maturity Level 3
223 steps:
224 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/build_release.distributionPointsUseHTTPS
225 description: When the project lists a URI as an official distribution channel,
226 that URI MUST be exclusively delivered using encrypted channels.
227 result: Passed
228 message: No official distribution points found in Security Insights data
229 steps-executed: 1
230 start: 2025-08-22T16:02:00.000000000Z
231 end: 2025-08-22T16:02:00.000000584Z
232 control:
233 reference-id: OSPS-B
234 entry-id: OSPS-BR-03
235 result: Needs Review
236 message: No official distribution points found in Security Insights data
237- name: ''
238 assessment-logs:
239 - requirement:
240 entry-id: OSPS-BR-04.01
241 applicability:
242 - Maturity Level 2
243 - Maturity Level 3
244 steps:
245 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.HasMadeReleases
246 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/build_release.ensureLatestReleaseHasChangelog
247 description: When an official release is created, that release MUST contain a
248 descriptive log of functional and security modifications.
249 result: Not Run
250 message: '""'
251 steps-executed: 0
252 start: 2025-08-22T16:02:00.000000000Z
253 control:
254 reference-id: OSPS-B
255 entry-id: OSPS-BR-04
256 result: Not Run
257 message: '""'
258- name: ''
259 assessment-logs:
260 - requirement:
261 entry-id: OSPS-BR-05.01
262 applicability:
263 - Maturity Level 2
264 - Maturity Level 3
265 steps:
266 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.NotImplemented
267 description: When a build and release pipeline ingests dependencies, it MUST use
268 standardized tooling where available.
269 result: Not Run
270 message: '""'
271 steps-executed: 0
272 start: 2025-08-22T16:02:00.000000000Z
273 control:
274 reference-id: OSPS-B
275 entry-id: OSPS-BR-05
276 result: Not Run
277 message: '""'
278- name: ''
279 assessment-logs:
280 - requirement:
281 entry-id: OSPS-BR-06.01
282 applicability:
283 - Maturity Level 2
284 - Maturity Level 3
285 steps:
286 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.HasMadeReleases
287 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.HasSecurityInsightsFile
288 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/build_release.insightsHasSlsaAttestation
289 description: When an official release is created, that release MUST be signed
290 or accounted for in a signed manifest including each asset's cryptographic hashes.
291 result: Not Run
292 message: '""'
293 steps-executed: 0
294 start: 2025-08-22T16:02:00.000000000Z
295 control:
296 reference-id: OSPS-B
297 entry-id: OSPS-BR-06
298 result: Not Run
299 message: '""'
300- name: ''
301 assessment-logs:
302 - requirement:
303 entry-id: OSPS-DO-01.01
304 applicability:
305 - Maturity Level 1
306 - Maturity Level 2
307 - Maturity Level 3
308 steps:
309 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.HasMadeReleases
310 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.HasSecurityInsightsFile
311 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/docs.hasUserGuides
312 description: When the project has made a release, the project documentation MUST
313 include user guides for all basic functionality.
314 result: Failed
315 message: User guide was NOT specified in Security Insights data
316 steps-executed: 3
317 start: 2025-08-22T16:02:00.000000000Z
318 control:
319 reference-id: OSPS-B
320 entry-id: OSPS-DO-01
321 result: Failed
322 message: User guide was NOT specified in Security Insights data
323- name: ''
324 assessment-logs:
325 - requirement:
326 entry-id: OSPS-DO-02.01
327 applicability:
328 - Maturity Level 1
329 - Maturity Level 2
330 - Maturity Level 3
331 steps:
332 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.HasMadeReleases
333 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.HasIssuesOrDiscussionsEnabled
334 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/docs.acceptsVulnReports
335 description: When the project has made a release, the project documentation MUST
336 include a guide for reporting defects.
337 result: Failed
338 message: Repository does not accept vulnerability reports
339 steps-executed: 3
340 start: 2025-08-22T16:02:00.000000000Z
341 control:
342 reference-id: OSPS-B
343 entry-id: OSPS-DO-02
344 result: Failed
345 message: Repository does not accept vulnerability reports
346- name: ''
347 assessment-logs:
348 - requirement:
349 entry-id: OSPS-DO-03.01
350 applicability:
351 - Maturity Level 3
352 steps:
353 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.HasMadeReleases
354 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.HasSecurityInsightsFile
355 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/docs.hasSignatureVerificationGuide
356 description: When the project has made a release, the project documentation MUST
357 contain instructions to verify the integrity and authenticity of the release
358 assets.
359 result: Not Run
360 message: '""'
361 steps-executed: 0
362 start: 2025-08-22T16:02:00.000000000Z
363 control:
364 reference-id: OSPS-B
365 entry-id: OSPS-DO-03
366 result: Not Run
367 message: '""'
368- name: ''
369 assessment-logs:
370 - requirement:
371 entry-id: OSPS-DO-04.01
372 applicability:
373 - Maturity Level 3
374 steps:
375 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/docs.hasSupportDocs
376 description: When the project has made a release, the project documentation MUST
377 include a descriptive statement about the scope and duration of support for
378 each release.
379 result: Not Run
380 message: '""'
381 steps-executed: 0
382 start: 2025-08-22T16:02:00.000000000Z
383 control:
384 reference-id: OSPS-B
385 entry-id: OSPS-DO-04
386 result: Not Run
387 message: '""'
388- name: ''
389 assessment-logs:
390 - requirement:
391 entry-id: OSPS-DO-05.01
392 applicability:
393 - Maturity Level 3
394 steps:
395 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/docs.hasSupportDocs
396 description: When the project has made a release, the project documentation MUST
397 provide a descriptive statement when releases or versions will no longer receive
398 security updates.
399 result: Not Run
400 message: '""'
401 steps-executed: 0
402 start: 2025-08-22T16:02:00.000000000Z
403 control:
404 reference-id: OSPS-B
405 entry-id: OSPS-DO-05
406 result: Not Run
407 message: '""'
408- name: ''
409 assessment-logs:
410 - requirement:
411 entry-id: OSPS-DO-06.01
412 applicability:
413 - Maturity Level 2
414 - Maturity Level 3
415 steps:
416 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.IsCodeRepo
417 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.HasMadeReleases
418 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.HasSecurityInsightsFile
419 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/docs.hasDependencyManagementPolicy
420 description: When the project has made a release, the project documentation MUST
421 include a description of how the project selects, obtains, and tracks its dependencies.
422 result: Not Run
423 message: '""'
424 steps-executed: 0
425 start: 2025-08-22T16:02:00.000000000Z
426 control:
427 reference-id: OSPS-B
428 entry-id: OSPS-DO-06
429 result: Not Run
430 message: '""'
431- name: ''
432 assessment-logs:
433 - requirement:
434 entry-id: OSPS-GV-01.01
435 applicability:
436 - Maturity Level 2
437 - Maturity Level 3
438 steps:
439 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.HasSecurityInsightsFile
440 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.IsActive
441 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/governance.coreTeamIsListed
442 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/governance.projectAdminsListed
443 description: While active, the project documentation MUST include a list of project
444 members with access to sensitive resources.
445 result: Not Run
446 message: '""'
447 steps-executed: 0
448 start: 2025-08-22T16:02:00.000000000Z
449 - requirement:
450 entry-id: OSPS-GV-01.02
451 applicability:
452 - Maturity Level 2
453 - Maturity Level 3
454 steps:
455 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/governance.hasRolesAndResponsibilities
456 description: While active, the project documentation MUST include descriptions
457 of the roles and responsibilities for members of the project.
458 result: Not Run
459 message: '""'
460 steps-executed: 0
461 start: 2025-08-22T16:02:00.000000000Z
462 control:
463 reference-id: OSPS-B
464 entry-id: OSPS-GV-01
465 result: Not Run
466 message: '""'
467- name: ''
468 assessment-logs:
469 - requirement:
470 entry-id: OSPS-GV-02.01
471 applicability:
472 - Maturity Level 1
473 - Maturity Level 2
474 - Maturity Level 3
475 steps:
476 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.HasIssuesOrDiscussionsEnabled
477 description: While active, the project MUST have one or more mechanisms for public
478 discussions about proposed changes and usage obstacles.
479 result: Passed
480 message: Issues are enabled for the repository
481 steps-executed: 1
482 start: 2025-08-22T16:02:00.000000000Z
483 end: 2025-08-22T16:02:00.000000292Z
484 control:
485 reference-id: OSPS-B
486 entry-id: OSPS-GV-02
487 result: Passed
488 message: Issues are enabled for the repository
489- name: ''
490 assessment-logs:
491 - requirement:
492 entry-id: OSPS-GV-03.01
493 applicability:
494 - Maturity Level 1
495 - Maturity Level 2
496 - Maturity Level 3
497 steps:
498 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/governance.hasContributionGuide
499 description: While active, the project documentation MUST include an explanation
500 of the contribution process.
501 result: Needs Review
502 message: '"Contributing guide was found via GitHub API (Recommendation: Add code
503 of conduct location to Security Insights data)"'
504 steps-executed: 1
505 start: 2025-08-22T16:02:00.000000000Z
506 end: 2025-08-22T16:02:00.000000792Z
507 - requirement:
508 entry-id: OSPS-GV-03.02
509 applicability:
510 - Maturity Level 2
511 - Maturity Level 3
512 steps:
513 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.IsCodeRepo
514 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.HasSecurityInsightsFile
515 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.IsActive
516 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/governance.hasContributionReviewPolicy
517 description: While active, the project documentation MUST include a guide for
518 code contributors that includes requirements for acceptable contributions.
519 result: Not Run
520 message: '""'
521 steps-executed: 0
522 start: 2025-08-22T16:02:00.000000000Z
523 control:
524 reference-id: OSPS-B
525 entry-id: OSPS-GV-03
526 result: Needs Review
527 message: '"Contributing guide was found via GitHub API (Recommendation: Add code
528 of conduct location to Security Insights data)"'
529- name: ''
530 assessment-logs:
531 - requirement:
532 entry-id: OSPS-GV-04.01
533 applicability:
534 - Maturity Level 3
535 steps:
536 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.NotImplemented
537 description: While active, the project documentation MUST have a policy that code
538 contributors are reviewed prior to granting escalated permissions to sensitive
539 resources.
540 result: Not Run
541 message: '""'
542 steps-executed: 0
543 start: 2025-08-22T16:02:00.000000000Z
544 control:
545 reference-id: OSPS-B
546 entry-id: OSPS-GV-04
547 result: Not Run
548 message: '""'
549- name: ''
550 assessment-logs:
551 - requirement:
552 entry-id: OSPS-LE-01.01
553 applicability:
554 - Maturity Level 2
555 - Maturity Level 3
556 steps:
557 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.GithubTermsOfService
558 description: While active, the version control system MUST require all code contributors
559 to assert that they are legally authorized to make the associated contributions
560 on every commit.
561 result: Not Run
562 message: '""'
563 steps-executed: 0
564 start: 2025-08-22T16:02:00.000000000Z
565 control:
566 reference-id: OSPS-B
567 entry-id: OSPS-LE-01
568 result: Not Run
569 message: '""'
570- name: ''
571 assessment-logs:
572 - requirement:
573 entry-id: OSPS-LE-02.01
574 applicability:
575 - Maturity Level 1
576 - Maturity Level 2
577 - Maturity Level 3
578 steps:
579 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/legal.foundLicense
580 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/legal.goodLicense
581 description: While active, the license for the source code MUST meet the OSI Open
582 Source Definition or the FSF Free Software Definition.
583 result: Needs Review
584 message: All license found are OSI or FSF approved
585 steps-executed: 2
586 start: 2025-08-22T16:02:00.000000000Z
587 end: 2025-08-22T16:02:00.269504834Z
588 control:
589 reference-id: OSPS-B
590 entry-id: OSPS-LE-02
591 result: Needs Review
592 message: All license found are OSI or FSF approved
593- name: ''
594 assessment-logs:
595 - requirement:
596 entry-id: OSPS-LE-03.01
597 applicability:
598 - Maturity Level 1
599 - Maturity Level 2
600 - Maturity Level 3
601 steps:
602 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/legal.foundLicense
603 description: While active, the license for the source code MUST be maintained
604 in the corresponding repository's LICENSE file, COPYING file, or LICENSE/ directory.
605 result: Passed
606 message: License was found in a well known location via the GitHub API
607 steps-executed: 1
608 start: 2025-08-22T16:02:00.000000000Z
609 end: 2025-08-22T16:02:00.000000875Z
610 - requirement:
611 entry-id: OSPS-LE-03.02
612 applicability:
613 - Maturity Level 1
614 - Maturity Level 2
615 - Maturity Level 3
616 steps:
617 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/legal.releasesLicensed
618 description: While active, the license for the released software assets MUST be
619 included in the released source code, or in a LICENSE file, COPYING file, or
620 LICENSE/ directory alongside the corresponding release assets.
621 result: Passed
622 message: GitHub releases include the license(s) in the released source code.
623 steps-executed: 1
624 start: 2025-08-22T16:02:00.000000000Z
625 end: 2025-08-22T16:02:00.000000375Z
626 control:
627 reference-id: OSPS-B
628 entry-id: OSPS-LE-03
629 result: Passed
630 message: GitHub releases include the license(s) in the released source code.
631- name: ''
632 assessment-logs:
633 - requirement:
634 entry-id: OSPS-QA-01.01
635 applicability:
636 - Maturity Level 1
637 - Maturity Level 2
638 - Maturity Level 3
639 steps:
640 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/quality.repoIsPublic
641 description: While active, the project's source code repository MUST be publicly
642 readable at a static URL.
643 result: Passed
644 message: Repository is public
645 steps-executed: 1
646 start: 2025-08-22T16:02:00.000000000Z
647 end: 2025-08-22T16:02:00.000000958Z
648 - requirement:
649 entry-id: OSPS-QA-01.02
650 applicability:
651 - Maturity Level 1
652 - Maturity Level 2
653 - Maturity Level 3
654 steps:
655 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.GithubBuiltIn
656 description: The version control system MUST contain a publicly readable record
657 of all changes made, who made the changes, and when the changes were made.
658 result: Passed
659 message: This control is enforced by GitHub for all projects
660 steps-executed: 1
661 start: 2025-08-22T16:02:00.000000000Z
662 end: 2025-08-22T16:02:00.000000375Z
663 control:
664 reference-id: OSPS-B
665 entry-id: OSPS-QA-01
666 result: Passed
667 message: This control is enforced by GitHub for all projects
668- name: ''
669 assessment-logs:
670 - requirement:
671 entry-id: OSPS-QA-02.01
672 applicability:
673 - Maturity Level 1
674 - Maturity Level 2
675 - Maturity Level 3
676 steps:
677 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/quality.verifyDependencyManagement
678 description: When the package management system supports it, the source code repository
679 MUST contain a dependency list that accounts for the direct language dependencies.
680 result: Passed
681 message: Found 8 dependency manifests from GitHub API
682 steps-executed: 1
683 start: 2025-08-22T16:02:00.000000000Z
684 end: 2025-08-22T16:02:00.000002667Z
685 - requirement:
686 entry-id: OSPS-QA-02.02
687 applicability:
688 - Maturity Level 3
689 steps:
690 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.NotImplemented
691 description: When the project has made a release, all compiled released software
692 assets MUST be delivered with a software bill of materials.
693 result: Not Run
694 message: '""'
695 steps-executed: 0
696 start: 2025-08-22T16:02:00.000000000Z
697 control:
698 reference-id: OSPS-B
699 entry-id: OSPS-QA-02
700 result: Passed
701 message: Found 8 dependency manifests from GitHub API
702- name: ''
703 assessment-logs:
704 - requirement:
705 entry-id: OSPS-QA-03.01
706 applicability:
707 - Maturity Level 2
708 - Maturity Level 3
709 steps:
710 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/quality.statusChecksAreRequiredByRulesets
711 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/quality.statusChecksAreRequiredByBranchProtection
712 description: When a commit is made to the primary branch, any automated status
713 checks for commits MUST pass or be manually bypassed.
714 result: Not Run
715 message: '""'
716 steps-executed: 0
717 start: 2025-08-22T16:02:00.000000000Z
718 control:
719 reference-id: OSPS-B
720 entry-id: OSPS-QA-03
721 result: Not Run
722 message: '""'
723- name: ''
724 assessment-logs:
725 - requirement:
726 entry-id: OSPS-QA-04.01
727 applicability:
728 - Maturity Level 1
729 - Maturity Level 2
730 - Maturity Level 3
731 steps:
732 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.IsCodeRepo
733 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.HasSecurityInsightsFile
734 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.IsActive
735 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/quality.insightsListsRepositories
736 description: While active, the project documentation MUST contain a list of any
737 codebases that are considered subprojects or additional repositories.
738 result: Failed
739 message: Insights does NOT contains a list of repositories
740 steps-executed: 4
741 start: 2025-08-22T16:02:00.000000000Z
742 control:
743 reference-id: OSPS-B
744 entry-id: OSPS-QA-04
745 result: Failed
746 message: Insights does NOT contains a list of repositories
747- name: ''
748 assessment-logs:
749 - requirement:
750 entry-id: OSPS-QA-05.01
751 applicability:
752 - Maturity Level 1
753 - Maturity Level 2
754 - Maturity Level 3
755 steps:
756 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/quality.noBinariesInRepo
757 description: While active, the version control system MUST NOT contain generated
758 executable artifacts.
759 result: Passed
760 message: No common binary file extensions were found in the repository
761 steps-executed: 1
762 start: 2025-08-22T16:02:00.000000000Z
763 end: 2025-08-22T16:02:00.729000709Z
764 control:
765 reference-id: OSPS-B
766 entry-id: OSPS-QA-05
767 result: Passed
768 message: No common binary file extensions were found in the repository
769- name: ''
770 assessment-logs:
771 - requirement:
772 entry-id: OSPS-QA-06.01
773 applicability:
774 - Maturity Level 2
775 - Maturity Level 3
776 steps:
777 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.IsCodeRepo
778 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/quality.hasOneOrMoreStatusChecks
779 description: Prior to a commit being accepted, the project's CI/CD pipelines MUST
780 run at least one automated test suite to ensure the changes meet expectations.
781 result: Not Run
782 message: '""'
783 steps-executed: 0
784 start: 2025-08-22T16:02:00.000000000Z
785 - requirement:
786 entry-id: OSPS-QA-06.02
787 applicability:
788 - Maturity Level 3
789 steps:
790 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/quality.documentsTestExecution
791 description: While active, project's documentation MUST clearly document when
792 and how tests are run.
793 result: Not Run
794 message: '""'
795 steps-executed: 0
796 start: 2025-08-22T16:02:00.000000000Z
797 - requirement:
798 entry-id: OSPS-QA-06.03
799 applicability:
800 - Maturity Level 3
801 steps:
802 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.IsCodeRepo
803 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/quality.documentsTestMaintenancePolicy
804 description: While active, the project's documentation MUST include a policy that
805 all major changes to the software produced by the project should add or update
806 tests of the functionality in an automated test suite.
807 result: Not Run
808 message: '""'
809 steps-executed: 0
810 start: 2025-08-22T16:02:00.000000000Z
811 control:
812 reference-id: OSPS-B
813 entry-id: OSPS-QA-06
814 result: Not Run
815 message: '""'
816- name: ''
817 assessment-logs:
818 - requirement:
819 entry-id: OSPS-QA-07.01
820 applicability:
821 - Maturity Level 3
822 steps:
823 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/quality.requiresNonAuthorApproval
824 description: When a commit is made to the primary branch, the project's version
825 control system MUST require at least one non-author approval of the changes
826 before merging.
827 result: Not Run
828 message: '""'
829 steps-executed: 0
830 start: 2025-08-22T16:02:00.000000000Z
831 control:
832 reference-id: OSPS-B
833 entry-id: OSPS-QA-07
834 result: Not Run
835 message: '""'
836- name: ''
837 assessment-logs:
838 - requirement:
839 entry-id: OSPS-SA-01.01
840 applicability:
841 - Maturity Level 2
842 - Maturity Level 3
843 steps:
844 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.NotImplemented
845 description: When the project has made a release, the project documentation MUST
846 include design documentation demonstrating all actions and actors within the
847 system.
848 result: Not Run
849 message: '""'
850 steps-executed: 0
851 start: 2025-08-22T16:02:00.000000000Z
852 control:
853 reference-id: OSPS-B
854 entry-id: OSPS-SA-01
855 result: Not Run
856 message: '""'
857- name: ''
858 assessment-logs:
859 - requirement:
860 entry-id: OSPS-SA-02.01
861 applicability:
862 - Maturity Level 2
863 - Maturity Level 3
864 steps:
865 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.NotImplemented
866 description: When the project has made a release, the project documentation MUST
867 include descriptions of all external software interfaces of the released software
868 assets.
869 result: Not Run
870 message: '""'
871 steps-executed: 0
872 start: 2025-08-22T16:02:00.000000000Z
873 control:
874 reference-id: OSPS-B
875 entry-id: OSPS-SA-02
876 result: Not Run
877 message: '""'
878- name: ''
879 assessment-logs:
880 - requirement:
881 entry-id: OSPS-SA-03.01
882 applicability:
883 - Maturity Level 2
884 - Maturity Level 3
885 steps:
886 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.NotImplemented
887 description: When the project has made a release, the project MUST perform a security
888 assessment to understand the most likely and impactful potential security problems
889 that could occur within the software.
890 result: Not Run
891 message: '""'
892 steps-executed: 0
893 start: 2025-08-22T16:02:00.000000000Z
894 - requirement:
895 entry-id: OSPS-SA-03.02
896 applicability:
897 - Maturity Level 3
898 steps:
899 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.NotImplemented
900 description: When the project has made a release, the project MUST perform a threat
901 modeling and attack surface analysis to understand and protect against attacks
902 on critical code paths, functions, and interactions within the system.
903 result: Not Run
904 message: '""'
905 steps-executed: 0
906 start: 2025-08-22T16:02:00.000000000Z
907 control:
908 reference-id: OSPS-B
909 entry-id: OSPS-SA-03
910 result: Not Run
911 message: '""'
912- name: ''
913 assessment-logs:
914 - requirement:
915 entry-id: OSPS-VM-01.01
916 applicability:
917 - Maturity Level 2
918 - Maturity Level 3
919 steps:
920 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.NotImplemented
921 description: While active, the project documentation MUST include a policy for
922 coordinated vulnerability reporting, with a clear timeframe for response.
923 result: Not Run
924 message: '""'
925 steps-executed: 0
926 start: 2025-08-22T16:02:00.000000000Z
927 control:
928 reference-id: OSPS-B
929 entry-id: OSPS-VM-01
930 result: Not Run
931 message: '""'
932- name: ''
933 assessment-logs:
934 - requirement:
935 entry-id: OSPS-VM-02.01
936 applicability:
937 - Maturity Level 1
938 steps:
939 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.IsCodeRepo
940 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/vuln_management.hasSecContact
941 description: While active, the project documentation MUST contain security contacts.
942 result: Failed
943 message: Security contacts were not specified in Security Insights data
944 steps-executed: 2
945 start: 2025-08-22T16:02:00.000000000Z
946 control:
947 reference-id: OSPS-B
948 entry-id: OSPS-VM-02
949 result: Failed
950 message: Security contacts were not specified in Security Insights data
951- name: ''
952 assessment-logs:
953 - requirement:
954 entry-id: OSPS-VM-03.01
955 applicability:
956 - Maturity Level 2
957 - Maturity Level 3
958 steps:
959 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.NotImplemented
960 description: While active, the project documentation MUST provide a means for
961 reporting security vulnerabilities privately to the security contacts within
962 the project.
963 result: Not Run
964 message: '""'
965 steps-executed: 0
966 start: 2025-08-22T16:02:00.000000000Z
967 control:
968 reference-id: OSPS-B
969 entry-id: OSPS-VM-03
970 result: Not Run
971 message: '""'
972- name: ''
973 assessment-logs:
974 - requirement:
975 entry-id: OSPS-VM-04.01
976 applicability:
977 - Maturity Level 2
978 - Maturity Level 3
979 steps:
980 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.NotImplemented
981 description: While active, the project documentation MUST publicly publish data
982 about discovered vulnerabilities.
983 result: Not Run
984 message: '""'
985 steps-executed: 0
986 start: 2025-08-22T16:02:00.000000000Z
987 - requirement:
988 entry-id: OSPS-VM-04.02
989 applicability:
990 - Maturity Level 3
991 steps:
992 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.NotImplemented
993 description: While active, any vulnerabilities in the software components not
994 affecting the project MUST be accounted for in a VEX document, augmenting the
995 vulnerability report with non-exploitability details.
996 result: Not Run
997 message: '""'
998 steps-executed: 0
999 start: 2025-08-22T16:02:00.000000000Z
1000 control:
1001 reference-id: OSPS-B
1002 entry-id: OSPS-VM-04
1003 result: Not Run
1004 message: '""'
1005- name: ''
1006 assessment-logs:
1007 - requirement:
1008 entry-id: OSPS-VM-05.01
1009 applicability:
1010 - Maturity Level 3
1011 steps:
1012 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.NotImplemented
1013 description: While active, the project documentation MUST include a policy that
1014 defines a threshold for remediation of SCA findings related to vulnerabilities
1015 and licenses.
1016 result: Not Run
1017 message: '""'
1018 steps-executed: 0
1019 start: 2025-08-22T16:02:00.000000000Z
1020 - requirement:
1021 entry-id: OSPS-VM-05.02
1022 applicability:
1023 - Maturity Level 3
1024 steps:
1025 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.NotImplemented
1026 description: While active, the project documentation MUST include a policy to
1027 address SCA violations prior to any release.
1028 result: Not Run
1029 message: '""'
1030 steps-executed: 0
1031 start: 2025-08-22T16:02:00.000000000Z
1032 - requirement:
1033 entry-id: OSPS-VM-05.03
1034 applicability:
1035 - Maturity Level 3
1036 steps:
1037 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.NotImplemented
1038 description: While active, all changes to the project's codebase MUST be automatically
1039 evaluated against a documented policy for malicious dependencies and known vulnerabilities
1040 in dependencies, then blocked in the event of violations, except when declared
1041 and suppressed as non-exploitable.
1042 result: Not Run
1043 message: '""'
1044 steps-executed: 0
1045 start: 2025-08-22T16:02:00.000000000Z
1046 control:
1047 reference-id: OSPS-B
1048 entry-id: OSPS-VM-05
1049 result: Not Run
1050 message: '""'
1051- name: ''
1052 assessment-logs:
1053 - requirement:
1054 entry-id: OSPS-VM-06.01
1055 applicability:
1056 - Maturity Level 3
1057 steps:
1058 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.HasDependencyManagementPolicy
1059 description: While active, the project documentation MUST include a policy that
1060 defines a threshold for remediation of SAST findings.
1061 result: Not Run
1062 message: '""'
1063 steps-executed: 0
1064 start: 2025-08-22T16:02:00.000000000Z
1065 - requirement:
1066 entry-id: OSPS-VM-06.02
1067 applicability:
1068 - Maturity Level 3
1069 steps:
1070 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.IsCodeRepo
1071 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/reusable_steps.HasSecurityInsightsFile
1072 - github.com/revanite-io/pvtr-github-repo/evaluation_plans/osps/vuln_management.sastToolDefined
1073 description: While active, all changes to the project's codebase MUST be automatically
1074 evaluated against a documented policy for security weaknesses and blocked in
1075 the event of violations except when declared and suppressed as non-exploitable.
1076 result: Not Run
1077 message: '""'
1078 steps-executed: 0
1079 start: 2025-08-22T16:02:00.000000000Z
1080 control:
1081 reference-id: OSPS-B
1082 entry-id: OSPS-VM-06
1083 result: Not Run
1084 message: '""'