dennis-otto.github.io

There is one version in use: the website that GitHub Pages serves, which every change of main publishes and the daily build refreshes, so every visitor gets the latest without doing anything, and no older version needs fixes; SECURITY.md provides security fixes for the latest release: https://github.com/Dennis-Otto/dennis-otto.github.io/blob/main/SECURITY.md#supported-versions

GitHub Issues, with forms for bugs and feature requests: https://github.com/Dennis-Otto/dennis-otto.github.io/issues

No vulnerability was reported or resolved in the last 12 months; the repository has no security advisory. SECURITY.md promises credit in the advisory and the release notes to every reporter who doesn't prefer anonymity: https://github.com/Dennis-Otto/dennis-otto.github.io/blob/main/SECURITY.md#what-happens-next

SECURITY.md documents the process: private reporting through GitHub, acknowledgement within 7 days, a first assessment within 14 days, a fix of a confirmed vulnerability within 90 days at the latest, an update at least every 14 days when it takes longer, and disclosure in a GitHub security advisory and the release notes with credit for the reporter: https://github.com/Dennis-Otto/dennis-otto.github.io/blob/main/SECURITY.md#what-happens-next

The selected standards are enforced: scripts/check.sh runs ShellCheck and checks every text file, the Lint workflow runs actionlint, markdownlint, REUSE and the check of the sign-offs, and zizmor audits the workflows; all are required checks of every pull request. The Python and the JavaScript have no selected style yet, as coding_standards says.

The project produces no native binaries: MkDocs turns Markdown into HTML, and the scripts of the website are JavaScript that the browser runs from source.

Nothing strips or minifies the code of the website: MkDocs copies docs/javascripts/projects.js as it is written and the templates put the scripts of overrides/partials/ inline unchanged, so a browser's debugger shows them as in the repository; there is no compiled code with debugging information.

MkDocs builds the whole website in one run from mkdocs.yml; no build runs in a subdirectory.

The software is a website, which visitors open at https://dennis-otto.github.io/ in a browser: nothing is installed or uninstalled. A copy of its own builds with mkdocs build, as the README shows.

There is no installation: GitHub Pages serves the website that the Docs workflow builds.

CONTRIBUTING.md shows how to set up everything to make and test changes: a virtual environment .venv-docs with pip install --require-hashes -r .github/docs-requirements.txt for the website, then bash scripts/check.sh runs every check of the CI and installs the hash-pinned tools of the tests itself. The dev container in .devcontainer/ sets it up in one step for VS Code and GitHub Codespaces, and git config core.hooksPath .githooks runs the checks before every push: https://github.com/Dennis-Otto/dennis-otto.github.io/blob/main/CONTRIBUTING.md#checks

The tools of the build are listed and pinned with their hashes in .github/docs-requirements.txt, those of the tests in requirements-test.in and requirements-test.txt, and playwright-core of the browser tests in tests/e2e/package.json and its package-lock.json; the hooks and the scripts of the website need nothing but the standard library of Python and the browser: https://github.com/Dennis-Otto/dennis-otto.github.io/blob/main/.github/docs-requirements.txt

Renovate updates the dependencies, an update that fixes a vulnerability at once; OSV-Scanner checks every lock file in every pull request that changes one, after every change of main and every week, and reports to code scanning, where the Findings workflow keeps every finding fixed or accepted with a reason; the dependency review blocks a pull request that brings in a dependency with a known vulnerability: https://github.com/Dennis-Otto/dennis-otto.github.io/blob/main/.github/workflows/osv-scanner.yml

The hooks and the scripts of the website use only the standard library of Python and the APIs of the browser; the tools of the build, the tests and the checks come from pip and npm, pinned in lock files with hashes, every action by its commit hash, and Renovate and the updates of the blueprint keep them current. No third-party code is copied into the repository.

pytest runs with -W error, so a deprecated API of Python or of a tool that warns fails the tests, and the strict build fails on every warning of MkDocs and its plugins; Renovate and the blueprint keep the tools current. The end of the maintenance of Material for MkDocs is named as a residual risk on the security page: https://dennis-otto.github.io/security.html#residual-risks

The CI runs scripts/check.sh, with the tests of the hooks and of the scripts and their coverage gates, on every push to main and on every pull request, and the check docs runs the scenarios in Chrome on the built website; both report success or failure as required checks: https://github.com/Dennis-Otto/dennis-otto.github.io/blob/main/.github/workflows/ci.yml

All 3 bugs fixed in the last six months brought tests: the search of the hub (#72), the Trust page on a phone (#79) and the untested inline scripts (#83).

scripts/check-project.sh runs the tests of the hooks under coverage.py, a FLOSS tool, and fails below 100 % of their lines and branches, and the tests of the browser scripts with the coverage of Node's test runner, which fails below 100 % of their lines, branches and functions: https://github.com/Dennis-Otto/dennis-otto.github.io/blob/main/scripts/check-project.sh

CONTRIBUTING.md has the written policy: changes need tests, and the checks of scripts/check.sh pass; GOVERNANCE.md asks every contributor for tests for every new function and every fix, and the checklist of the pull request template asks for them: https://github.com/Dennis-Otto/dennis-otto.github.io/blob/main/CONTRIBUTING.md#requirements-for-changes

The instructions for change proposals in CONTRIBUTING.md require tests with every change, and the checklist of the pull request template asks for tests that cover it: https://github.com/Dennis-Otto/dennis-otto.github.io/blob/main/CONTRIBUTING.md#requirements-for-changes

MkDocs builds the website with --strict, so every warning of MkDocs, Material and the hooks fails the check docs, such as a link or an anchor that leads nowhere or a page without its German translation; pytest runs the tests of the hooks with -W error, so every warning of Python fails them; a finding of ShellCheck, actionlint, zizmor or markdownlint fails its required check: https://github.com/Dennis-Otto/dennis-otto.github.io/blob/main/scripts/check-project.sh

The repository and its releases apply least privilege, fail-safe defaults, complete mediation, separation of privilege, least common mechanism, economy of mechanism, open design and psychological acceptability, as the assurance case of SECURITY.md shows; the security page shows the secure design of the website: static pages without cookies or sign-in, fonts and scripts from the address itself, a deploy job alone that publishes with a short-lived OIDC token, a catalog bot whose comparison holds no secret, and only text of the notes of releases and of the search indexes of other websites: https://dennis-otto.github.io/security.html#trust-boundaries

The website implements no security mechanism with cryptography of its own: HTTPS comes from GitHub Pages, which accepts only TLS 1.2 and 1.3, and the hooks download with Python's ssl module.

The website implements no cryptographic algorithm of its own; TLS comes from GitHub Pages, the browser and Python's ssl module.

The only credentials are those of GitHub: the hooks read a token from the environment, GITHUB_TOKEN or GH_TOKEN, when it is set, and the private key of the release app is the secret RELEASE_AUTOMATION_PRIVATE_KEY of the environment release, separate from every file, the configuration and the logs, and replaced with gh secret set without any change of code; the website itself holds no credential.

Every connection uses HTTPS: GitHub Pages serves the website only over HTTPS, answers http:// with a redirect and sends HSTS for a year; a page asks only its own address and api.github.com, and an outdated browser also unpkg, over HTTPS; every address of a card starts with https://, and the hooks download only https addresses.

GitHub Pages accepts TLS 1.2 and 1.3 and refuses older versions, and the hooks use the default context of Python's ssl module, whose minimum is TLS 1.2.

Browsers verify the certificate of GitHub Pages, and the hooks download with urllib and the default context of Python's ssl module, which verifies certificates and host names; nothing turns that off.

The website sends no cookie and no private header. The hooks send a token only to api.github.com, after urllib's TLS handshake has verified the certificate, and never on to a redirect (add_unredirected_header).

Releases are immutable, GitHub signs an attestation that ties each tag to its commit and its files, the release workflow signs the build provenance of every file with Sigstore, without a long-lived key, and every release tag is signed with gitsign; the job that publishes the website signs its provenance as well. SECURITY.md documents how users verify both: https://github.com/Dennis-Otto/dennis-otto.github.io/blob/main/SECURITY.md#verify-a-release

The release workflow signs every release tag without a key with gitsign, v0.1.0 to v1.6.0 so far, and builds no release on a tag that it didn't sign; nobody can move or delete a release tag: https://github.com/Dennis-Otto/dennis-otto.github.io/blob/main/.github/sign-tag.sh

Every untrusted input is checked against an allowlist: of the notes of a release only text, lists, headings, tables, code, quotes and links to https reach a page, without an attribute but the address; of a search index of a project website only the plain text of its titles and excerpts, escaped, and an index that isn't one stays out; of a file of a release only a version that VERSION matches; in the browser, projects.js takes from the data of the dashboard only values of the right type and range, dates of their pattern and links to github.com, and the 404 page leads only to the folders that its data names: https://dennis-otto.github.io/security.html#threats-and-countermeasures

GitHub Pages enforces HTTPS with HSTS; every script of the website runs in strict mode and writes only text and elements, never HTML; the website serves its fonts and scripts itself, sets no cookie and registers no service worker; projects.js asks for the data of the dashboard with a time limit, and so do the downloads of the hooks; the notes of releases and the search indexes of other websites are reduced to text before they reach a page.

SECURITY.md has the assurance case of the repository and its releases: the threat model, the trust boundaries, the secure design principles and how the OWASP Top 10 CI/CD security risks are countered. The security page completes it for the website: what visitors can expect, its six trust boundaries, its threats with countermeasures and the tests that pin them, and the residual risks: https://github.com/Dennis-Otto/dennis-otto.github.io/blob/main/SECURITY.md#assurance-case https://dennis-otto.github.io/security.html#threats-and-countermeasures

CodeQL runs its security-extended queries on the workflows on every pull request, after every change of main and every week, zizmor audits the workflows for their known attack patterns, and ShellCheck checks the shell scripts: https://github.com/Dennis-Otto/dennis-otto.github.io/blob/main/.github/workflows/codeql.yml

The website has no code in a memory-unsafe language: Python, JavaScript, HTML templates and shell scripts.