p4gs/sscs-bootstrapper

B provisional

https://github.com/p4gs/sscs-bootstrapper · scanned 2026-09-02 at 36772562085c on main · sscsb 0.3.0 · methodology v1 · scan run · authenticated

Overall: 81.8% · evidence coverage: 66.7% · provisional

verified needs attention unverified — outside the math

Raw sscsb verdicts and every reclassification are shown — transparency about what was and wasn't verifiable is the product.

Phase 1 — Commit integrity

4 pass · 0 fail/gap · 5 unverified

100%

Pass
secrets raw: degraded
runner-tool availability is the scanner's environment, not the repository's; all registered artifacts pre-exist
evidence
- pre-commit + commit-msg + pre-push shims installed, executable, and unmodified (core.hooksPath=.sscsb/hooks)
- trufflehog not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 3.95.9. Install: brew install trufflehog (Linuxbrew) or see Release binaries: https://github.com/trufflesecurity/trufflehog/releases (https://github.com/trufflesecurity/trufflehog)
- gitleaks not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 8.30.1. Install: brew install gitleaks (Linuxbrew) or see Release binaries: https://github.com/gitleaks/gitleaks/releases (https://github.com/gitleaks/gitleaks)
Unverified
commit-signing raw: pass
requires the local development environment; not observable in a repository scan
evidence
- pre-commit + commit-msg + pre-push shims installed, executable, and unmodified (core.hooksPath=.sscsb/hooks)
- 1 approved signer(s), 1 human
- git config `gpg.format` unset — see docs/signing.md for YubiKey ed25519-sk setup
- git config `user.signingkey` unset — see docs/signing.md for YubiKey ed25519-sk setup
- git config `commit.gpgSign` unset — see docs/signing.md for YubiKey ed25519-sk setup
Info
agent-signing out of scope raw: disabled
optional control not enabled by this repository
evidence
- disabled in .sscsb/config.toml
Unverified
signing-model raw: degraded
requires the local development environment; not observable in a repository scan
evidence
- human-local: incomplete — run `sscsb signing setup human-local`
- agent-claude-code: incomplete — run `sscsb signing setup agent-claude-code`
- cloud-claude: repo-side attribution is probeable and is not in place — an attestation cannot stand in for it
- cloud-claude: github_app_installed: not attested — `sscsb signing setup cloud-claude --confirm`
- github-web: vigilant_mode: not attested — `sscsb signing setup github-web --confirm`
- github-web: phishing_resistant_mfa: not attested — `sscsb signing setup github-web --confirm`
- codespaces: gpg_verification: not attested — `sscsb signing setup codespaces --confirm`
Pass
branch-protection
evidence
- main: required pull requests ✓
- main: force-push blocking ✓
- main: required signed commits ✓
- main: required status checks ✓
- main: deletion protection ✓
- main: Scorecard — stale-review dismissal ✓
- main: Scorecard gap — ≥1 required approving review off (needs a 2nd reviewer; a solo maintainer cannot self-approve — opt in with `sscsb harden branch-protection --require-reviews` once you have one)
- main: Scorecard gap — code-owner review off (needs a 2nd reviewer; a solo maintainer cannot self-approve — opt in with `sscsb harden branch-protection --require-reviews` once you have one)
Pass
actions-audit
evidence
- all workflows pass (SHA-pinned, least-privilege)
Info
gittuf out of scope raw: disabled
optional control not enabled by this repository
evidence
- disabled in .sscsb/config.toml
Unverified
ai-trailers raw: pass
requires the local development environment; not observable in a repository scan
evidence
- enforced by the commit-msg hook
- pre-commit + commit-msg + pre-push shims installed, executable, and unmodified (core.hooksPath=.sscsb/hooks)
Unverified
ai-dep-gate raw: pass
requires the local development environment; not observable in a repository scan
evidence
- enforced by the commit-msg hook
- pre-commit + commit-msg + pre-push shims installed, executable, and unmodified (core.hooksPath=.sscsb/hooks)
Pass
pr-template
evidence
- AI-provenance PR template installed (code/tests/deps/docs questions)
Unverified
ai-receipts raw: degraded
requires the local development environment; not observable in a repository scan
evidence
- receipts: `sscsb receipt create [commit]` → .sscsb/out/receipts/, `sscsb receipt verify <file>` recomputes the patch digest, re-reads the commit's AI trailers, and verifies any cosign bundle beside the receipt
- cosign not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 3.1.1. Install: brew install cosign (Linuxbrew) or see Release binaries: https://github.com/sigstore/cosign/releases (https://github.com/sigstore/cosign)

Phase 2 — Dependencies & SBOM

3 pass · 0 fail/gap · 5 unverified

100%

Pass
sbom raw: degraded
runner-tool availability is the scanner's environment, not the repository's; all registered artifacts pre-exist
evidence
- syft not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 1.46.0. Install: brew install syft (Linuxbrew) or see Release binaries: https://github.com/anchore/syft/releases (https://github.com/anchore/syft)
Pass
vuln-scan raw: degraded
runner-tool availability is the scanner's environment, not the repository's; all registered artifacts pre-exist
evidence
- trivy not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 0.72.0. Install: brew install trivy (Linuxbrew) or see Release binaries: https://github.com/aquasecurity/trivy/releases (https://github.com/aquasecurity/trivy)
- osv-scanner not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 2.4.0. Install: brew install osv-scanner (Linuxbrew) or see Release binaries: https://github.com/google/osv-scanner/releases (https://github.com/google/osv-scanner)
- scanner config: .trivyignore is present with 2 entr(ies): DS-0002, DS-0026 — suppressions it causes are listed individually as `suppressed:` rows
Unverified
scorecard raw: degraded
evidence
- .github/workflows/scorecard.yml installed
- live Scorecard results could not be read (none published yet — the workflow runs on push to the default branch — or the code-scanning API refused) — posture unverified
Pass
renovate
evidence
- renovate.json5 installed (7 key(s))
Unverified
package-trust raw: pass
requires the local development environment; not observable in a repository scan
evidence
- new-package approval gate enforced in commit-msg hook
- pre-commit + commit-msg + pre-push shims installed, executable, and unmodified (core.hooksPath=.sscsb/hooks)
- approved baseline present (17 package(s))
- registry existence validation ON for `sscsb deps check` and approvals (anti-slopsquat)
- typosquat proximity heuristic ON for `sscsb deps check`, approvals, and the commit gate
Unverified
bumblebee raw: degraded
requires the local development environment; not observable in a repository scan
evidence
- bumblebee not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 0.1.2. Install: brew install bumblebee (Linuxbrew) or see Read-only endpoint inventory scanner (Go, zero dependencies). Release binaries: https://github.com/perplexityai/bumblebee/releases — exposur…
Unverified
grype raw: degraded
requires the local development environment; not observable in a repository scan
evidence
- grype not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 0.115.0. Install: brew install grype (Linuxbrew) or see Release binaries: https://github.com/anchore/grype/releases (https://github.com/anchore/grype)
Unverified
socket-firewall raw: degraded
requires the local development environment; not observable in a repository scan
evidence
- Socket Firewall CLI (sfw) not found — install per https://docs.socket.dev/docs/socket-firewall and wrap installs: `sfw npm install`, `sfw pip install`, `sfw cargo add`
- socket-firewall blocks known-malicious packages at install time (optional layer)

Phase 3 — Provenance

4 pass · 4 fail/gap · 0 unverified

50%

Gap
sigstore-signing raw: disabled
evidence installed by the scanner's own init (.github/workflows/release-sign.yml) — absent from the repository
evidence
- disabled in .sscsb/config.toml
Gap
slsa-provenance raw: disabled
evidence installed by the scanner's own init (.github/workflows/release-slsa.yml) — absent from the repository
evidence
- disabled in .sscsb/config.toml
Gap
github-attestations raw: disabled
evidence installed by the scanner's own init (.github/workflows/release-attest.yml) — absent from the repository
evidence
- disabled in .sscsb/config.toml
Gap
sbom-attestation raw: disabled
evidence installed by the scanner's own init (.github/workflows/release-attest-sbom.yml) — absent from the repository
evidence
- disabled in .sscsb/config.toml
Info
model-signing out of scope raw: disabled
optional control not enabled by this repository
evidence
- disabled in .sscsb/config.toml
Pass
provenance-verify raw: degraded
runner-tool availability is the scanner's environment, not the repository's; all registered artifacts pre-exist
evidence
- slsa-verifier not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 2.7.1. Install: brew install slsa-verifier (Linuxbrew) or see Release binaries: https://github.com/slsa-framework/slsa-verifier/releases (https://github.com/slsa-framework/slsa-verifier)
- cosign not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 3.1.1. Install: brew install cosign (Linuxbrew) or see Release binaries: https://github.com/sigstore/cosign/releases (https://github.com/sigstore/cosign)
- gate: `sscsb provenance verify --artifact <f> --provenance <f>.intoto.jsonl --source-uri github.com/<owner>/<repo> --builder-id <trusted builder> [--source-tag vX.Y.Z]`
- no builder_id pinned under [controls.provenance-verify] — `provenance verify` will require --builder-id on the command line rather than trusting any builder
- deploy-gate workflow present (verification before publish)
Pass
release-immutability
evidence
- .github/workflows/release.yml installed (2 job(s))
Pass
octo-sts
evidence
- .github/workflows/octo-sts-example.yml installed (1 job(s))
- .github/chainguard/sscsb-automation.sts.yaml installed (3 key(s))
Pass
harden-runner
evidence
- cflite-pr.yml: harden-runner present in job `Fuzzing`
- ci.yml: harden-runner present in job `lint`
- ci.yml: harden-runner present in job `test`
- ci.yml: harden-runner present in job `coverage`
- codeql.yml: harden-runner present in job `analyze`
- deploy-gate.yml: harden-runner present in job `verify`
- deploy-gate.yml: harden-runner present in job `publish`
- octo-sts-example.yml: harden-runner present in job `federated-call`
Info
witness out of scope raw: disabled
optional control not enabled by this repository
evidence
- disabled in .sscsb/config.toml

Phase 4 — SAST & CI hardening

4 pass · 0 fail/gap · 0 unverified

100%

Pass
sast raw: degraded
runner-tool availability is the scanner's environment, not the repository's; all registered artifacts pre-exist
evidence
- engine: opengrep (rules: /home/runner/work/sscs-bootstrapper/sscs-bootstrapper/.sscsb/rules)
- local ruleset present (1 file(s))
- opengrep not found on PATH — this control cannot run its underlying tool. Pinned known-good version: 1.25.0. Install: No Homebrew formula; install a pinned release binary: https://github.com/opengrep/opengrep/releases (https://github.com/opengrep/opengrep)
Info
sighthound out of scope raw: disabled
optional control not enabled by this repository
evidence
- disabled in .sscsb/config.toml
Pass
codeql
evidence
- .github/workflows/codeql.yml installed (1 job(s))
Pass
fuzzing
evidence
- .github/workflows/cflite-pr.yml installed (1 job(s))
- .clusterfuzzlite/Dockerfile installed (present and non-empty; no machine-checkable structure — its substance is a human judgement sscsb does not assert)
- .clusterfuzzlite/build.sh installed (present and non-empty; no machine-checkable structure — its substance is a human judgement sscsb does not assert)
- .trivyignore installed (present and non-empty; no machine-checkable structure — its substance is a human judgement sscsb does not assert)
Pass
workflow-audit-extended
evidence
- all workflows pass (SHA-pinned, least-privilege)
Info
secure-repo out of scope
informational control — excluded from scoring
evidence
- StepSecurity secure-repo is a web service (app.stepsecurity.io), not an action; run it against this repo to auto-generate hardening PRs. See docs/phase-4.md.
Info
wait-for-secrets out of scope raw: disabled
optional control not enabled by this repository
evidence
- disabled in .sscsb/config.toml

Phase 5 — Continuous posture

3 pass · 0 fail/gap · 1 unverified

100%

Info
dependency-track out of scope raw: disabled
optional control not enabled by this repository
evidence
- disabled in .sscsb/config.toml
Info
guac out of scope raw: disabled
optional control not enabled by this repository
evidence
- disabled in .sscsb/config.toml
Unverified
openvex raw: info
requires the local development environment; not observable in a repository scan
evidence
- no OpenVEX documents in .sscsb/out — N/A for this repo until one is generated
- generate: `sscsb vex create --vuln CVE-… --product pkg:… --status not_affected --justification …`
- ingest: `sscsb scan --vex <file>` suppresses not_affected/fixed findings visibly
Info
oras out of scope raw: disabled
optional control not enabled by this repository
evidence
- disabled in .sscsb/config.toml
Pass
security-insights
evidence
- structurally valid — run `si validate` for full schema conformance
Pass
best-practices-badge
evidence
- .sscsb/best-practices-badge.md installed (present and non-empty; no machine-checkable structure — its substance is a human judgement sscsb does not assert)
Pass
osps-baseline
evidence
- .sscsb/osps-baseline.md installed (present and non-empty; no machine-checkable structure — its substance is a human judgement sscsb does not assert)
Info
compliance-map out of scope raw: pass
informational control — excluded from scoring
evidence
- map covers all 44 controls across SLSA/SSDF/CRA/Badge

Improve this score

This record came through the authenticated lane — published by the repository's own CI via the sscsb-action. Amber and hatched links above are the work list: adopt the flagged controls, re-run the action, and the next record replaces this one.

Action docs