× Note: The site will later be briefly unavailable due to database maintenance.

discovery-media-player

Miradi inayofuata mazoea bora hapa chini inaweza kujihakikisha kwa hiari na kuonyesha kuwa wamepata nishani ya mazoea bora ya Open Source Security Foundation (OpenSSF).

Hakuna seti ya mazoea yawezayo kuhakikisha kuwa programu haitakuwa na kasoro au udhaifu; hata mbinu rasmi zinaweza kushindwa ikiwa vipimo au dhana ni sahihi. Wala hakuna seti ya mazoea yawezayo kuhakikisha kuwa mradi utaendelea kuwa na jamii ya maendeleo yenye afya na inayofanya kazi vizuri. Hata hivyo, kufuata mazoea bora kunaweza kusaidia kuboresha matokeo ya miradi. Kwa mfano, baadhi ya mazoea huwezesha ukaguzi wa watu wengi kabla ya kutolewa, ambayo inaweza kusaidia kupata udhaifu wa kiufundi ambao vinginevyo ni vigumu kupata na kusaidia kujenga uaminifu na hamu ya mwingiliano wa kurudia kati ya wasanidi programu kutoka makampuni tofauti. Ili kupata nishani, vigezo vyote vya LAZIMA na LAZIMA WALA USIWAHI lazima vifuatwe, vigezo vyote vya INAPASWA lazima vifuatwe AU visivyo fufufutiliana na thibitisho, na vigezo vyote vya PENDEKEZA lazima vifuatwe AU visivyo fufufutiliana (tunataka vifikiwe angalau). Ikiwa unataka kuingiza maandishi ya thibitisho kama maoni ya jumla, badala ya kuwa maelezo ya busara kwamba hali ni inakubaliwa, anza kifungu cha maandishi na '//' ikifuatiwa na nafasi. Maoni ni karibu kupitia tovuti ya GitHub kama masuala au maombi ya kuvuta Kuna pia orodha ya barua pepe kwa majadiliano ya jumla.

Tunafuraha kutoa habari katika lugha nyingi, hata hivyo, ikiwa kuna mgongano au kutokuwa na usawa kati ya tafsiri, toleo la Kiingereza ni toleo lenye mamlaka.
Ikiwa huu ni mradi wako, tafadhali onyesha hali ya nishani yako ya msingi kwenye ukurasa wa mradi wako! Hali ya nishani ya msingi inaonekana kama hii: Kiwango cha nishani ya msingi kwa mradi 14197 ni baseline-2 Huu ndiyo jinsi ya kuweka nishani ya msingi:
Unaweza kuonyesha hali ya nishani yako ya msingi kwa kuweka hii katika faili yako ya markdown:
[![OpenSSF Baseline](https://www.bestpractices.dev/projects/14197/baseline)](https://www.bestpractices.dev/projects/14197)
au kwa kuweka hii katika HTML yako:
<a href="https://www.bestpractices.dev/projects/14197"><img src="https://www.bestpractices.dev/projects/14197/baseline"></a>


Hizi ni vigezo vya Kiwango cha Msingi 1. Hizi ni vigezo vya toleo v2026.02.19.

Baseline Series: Kiwango cha Msingi 1 Kiwango cha Msingi 2 Kiwango cha Msingi 3

        

 Misingi

  • Jumla

    Kumbuka kwamba miradi mingine inaweza kutumia jina sawa.

    Self-hosted document viewer: per-recipient tracked links, reading analytics, live presentation. The core knows nothing about the app hosting it.

    Tafadhali tumia muundo wa maneno ya leseni ya SPDX; mifano ni pamoja na "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "GPL-2.0+", "LGPL-3.0+", "MIT", na "(BSD-2-Clause OR Ruby)". Usitumie alama za nukuu za moja au mbili.
    Ikiwa kuna lugha zaidi ya moja, ziorodhe kama thamani zilizotengwa kwa koma (nafasi ni za hiari) na ziorodhe kuanzia iliyotumiwa zaidi hadi iliyotumiwa kidogo. Ikiwa kuna orodha ndefu, tafadhali orodhesha angalau tatu za kawaida zaidi. Ikiwa hakuna lugha (k.m., huu ni mradi wa nyaraka tu au wa majaribio tu), tumia herufi moja "-". Tafadhali tumia herufi kubwa za kawaida kwa kila lugha, k.m., "JavaScript".
    Common Platform Enumeration (CPE) ni mpango wa kuweka majina yenye muundo kwa mifumo ya teknolojia ya habari, programu, na vifurushi. Inatumika katika mifumo na hifadhidata nyingi wakati wa kuripoti udhaifu.

 Udhibiti 24/24 ●

  • Udhibiti


    Ya kutosha kwa nishani!

    Wakati mtumiaji anajaribu kusoma au kurekebisha rasilimali nyeti katika hifadhi ya mamlaka ya mradi, mfumo LAZIMA uhitaji mtumiaji kukamilisha mchakato wa uthibitishaji wa vipengele vingi. [OSPS-AC-01.01]
    Tekeleza uthibitishaji wa vipengele vingi kwa mfumo wa udhibiti wa toleo wa mradi, ikihitaji washirika kutoa aina ya pili ya uthibitishaji wakati wa kufikia data nyeti au kurekebisha mipangilio ya hifadhi. Funguo za kupitisha zinakubaliwa kwa udhibiti huu.

    The authoritative repository is hosted on GitHub, which requires two-factor authentication for every account that contributes code; accounts that do not enrol lose write access. Sensitive actions on this repository — pushing, changing settings, publishing a release — therefore require a second factor enforced by the platform, and the maintainer account has 2FA enabled.


    Ya kutosha kwa nishani!

    Wakati mshirika mpya anaongezwa, mfumo wa udhibiti wa toleo LAZIMA uhitaji mgawanyo wa ruhusa wa mikono, au kuzuia ruhusa za mshirika kwa upendeleo wa chini unapatikana kwa chaguo-msingi. [OSPS-AC-02.01]
    Mifumo mingi ya umma ya udhibiti wa toleo imesanidiwa kwa njia hii. Hakikisha mfumo wa udhibiti wa toleo wa mradi daima unapeana ruhusa za chini zinazopatikana kwa washirika kwa chaguo-msingi wanapongezwa, ikitoa ruhusa za ziada tu zinapohitajika.

    GitHub grants no write access implicitly. The repository is public, so reading requires no account and no grant at all, and any write role must be assigned per person through an explicit invitation accepted by that person. The repository is owned by a personal account with no organisation-wide default grants and no collaborator teams, so there is no path by which a new collaborator receives more than read access without a deliberate act.


    Ya kutosha kwa nishani!

    Wakati ahadi ya moja kwa moja inajaribiwa kwenye tawi kuu la mradi, utaratibu wa kutekeleza LAZIMA uzuie mabadiliko yasitekelezwe. [OSPS-AC-03.01]
    Ikiwa VCS ni ya kati, weka ulinzi wa tawi kwenye tawi kuu katika VCS ya mradi. Vinginevyo, tumia mbinu isiyokuwa ya kati, kama ile ya kernel ya Linux, ambapo mabadiliko kwanza hupendekeza katika hifadhi nyingine, na kuunganisha mabadiliko katika hifadhi kuu kunahitaji kitendo tofauti mahususi.

    main is a protected branch and is the repository default. Changes reach it only through pull requests: a direct push is rejected by the branch protection rule, and the required checks must pass first — lint, typecheck, 1515 tests across 144 files, and the supply-chain guards that verify every GitHub Action is pinned to a commit SHA, that container base images are pinned to a digest, and that the committed browser bundles still match their TypeScript sources.


    Ya kutosha kwa nishani!

    Wakati jaribio linafanywa kufuta tawi kuu la mradi, mfumo wa udhibiti wa toleo LAZIMA uichukulie hii kama shughuli nyeti na kuhitaji uthibitishaji wa wazi wa nia. [OSPS-AC-03.02]
    Weka ulinzi wa tawi kwenye tawi kuu katika mfumo wa udhibiti wa toleo wa mradi ili kuzuia ufutaji.

    main is protected, and GitHub refuses deletion of a protected branch outright rather than prompting for confirmation. It is additionally the repository's default branch, which cannot be deleted at all until another branch is designated as default — a deliberate settings change made by the owner.


    Ya kutosha kwa nishani!

    Wakati bomba la CI/CD linakubali kigezo cha ingizo, kigezo hicho LAZIMA kisafishwe na kuthibitishwa kabla ya kutumika katika bomba. [OSPS-BR-01.01]
    Mifuko ya CI/CD inapaswa kusafisha (kunukuu, kutoroka au kutoka kwa maadili yanayotarajiwa) pembejeo zote za metadata zinazohusiana na vyanzo visivyoaminika. Hii inajumuisha data kama vile majina ya matawi, ujumbe wa kujitolea, lebo, majina ya maombi ya kuvuta, na taarifa za mwandishi.

    The only workflow that reads untrusted metadata is .github/workflows/cla.yml, triggered by pull_request_target and issue_comment. Every untrusted value — comment body, comment author login and id, pull request number — is handed to the script through the env: block and read from the environment, never interpolated into a run: line, so none of it can be parsed as shell. All eight workflows were checked: no ${{ github.event.* }} expression is expanded inside any shell command anywhere in the repository.


    Ya kutosha kwa nishani!

    Wakati mfuko wa CI/CD unafanya kazi kwenye picha za nambari za kanuni ambazo haziaminiki, LAZIMA uzuie upatikanaji wa vitambulisho vya CI/CD vilivyopendelewa na mali. [OSPS-BR-01.03]
    Mifuko ya CI/CD inapaswa kutenga picha za nambari za kanuni ambazo haziaminiki kutoka kwa vitambulisho vilivyopendelewa na mali. Hasa, miradi inapaswa kuwa makini kuhakikisha kwamba mtiririko wa kazi ambao hujenga au kutekeleza nambari kabla ya ukaguzi na mshirika hana upatikanaji wa vitambulisho vya CI/CD.

    Workflows that run untrusted code hold no privileged credentials, and the workflow that holds credentials never runs untrusted code. ci.yml runs on pull_request with permissions: contents: read only. cla.yml runs with write scopes but checks out the base branch (ref: github.event.repository.default_branch), never the pull request head, so contributor code is never executed under the elevated token. release.yml declares permissions: {} at workflow level and grants the narrowest scope per job; npm publication uses OIDC trusted publishing, so no long-lived registry token exists in the repository to be stolen. All 35 action references across the eight workflows are pinned to 40-character commit SHAs, enforced by a CI guard.


    Ya kutosha kwa nishani!

    Wakati mradi unaorodhesha URI kama njia rasmi ya mradi, URI hiyo LAZIMA itolewa pekee kwa kutumia njia zilizosimbwa. [OSPS-BR-03.01]
    Sanidi tovuti za mradi na mifumo ya udhibiti wa toleo ili kutumia njia zilizosimbwa kama SSH au HTTPS kwa maambukizi ya data. Hakikisha zana zote na vikoa vilivyorejelewa katika nyaraka za mradi vinaweza kufikika tu kupitia njia zilizosimbwa.

    Every official URI is HTTPS: the repository, the homepage and bugs URLs declared in package.json, the security policy, the issue tracker, and every link in README.md, CONTRIBUTING.md, SECURITY.md, SUPPORT.md and the docs/ directory. A scan of the documentation and the manifest found no http:// URL other than loopback addresses used as local development examples.


    Ya kutosha kwa nishani!

    Wakati mradi unaorodhesha URI kama njia rasmi ya usambazaji, URI hiyo LAZIMA itolwe pekee kwa kutumia njia zilizosimbwa. [OSPS-BR-03.02]
    Sanidi mfumo wa kutolewa kwa mradi ili kuchukua data tu kutoka kwenye tovuti, majibu ya API, na huduma nyingine ambazo zinatumia njia zilizosimbwa kama SSH au HTTPS kwa maambukizi ya data.

    Releases travel only over authenticated channels. The npm package is published via OIDC trusted publishing (id-token: write, no stored token), which attaches a signed provenance attestation binding the tarball to the workflow and commit that built it. Container images go to GHCR with build provenance attestations. Source archives are served by GitHub Releases over HTTPS. Container base images are pinned by sha256 digest and all GitHub Actions by commit SHA, each enforced by a CI guard, so the inputs to a release are as authenticated as its outputs.


    Ya kutosha kwa nishani!

    Mradi LAZIMA uzuie uhifadhi wa bila makusudi wa data nyeti isiyo-imeimbwa, kama siri na vyeti, katika mfumo wa udhibiti wa toleo. [OSPS-BR-07.01]
    Sanidi .gitignore au sawa ili kutofautisha faili ambazo zinaweza kuwa na maelezo nyeti. Tumia vizuizi vya kabla ya kujitolea na zana za uchunguzi zilizosaidiwa na kompyuta ili kugundua na kuzuia ujumuishaji wa data nyeti katika michango.

    Three layers. .gitignore excludes .env and .env.* so the usual carrier never becomes a tracked file. tools/secrets-en-clair.mjs inspects every git-tracked file and refuses seven classes of credential recognisable by form — PEM private keys, AWS access key ids, GitHub, npm and Slack tokens, Google API keys, Stripe live keys — plus Supabase service_role JWTs identified by decoding the token payload, so the publishable key, which is meant to reach a browser, is not flagged. It additionally enforces the convention that in any .env* file a variable whose name denotes a secret carries no value, which catches the credential that has no recognisable form. The guard runs both in CI and in the pre-push hook that npm install places in every clone, so a credential is refused before it reaches the remote rather than reported after. Findings name the file, the line and the kind of credential and never the value, because a CI log on a public repository is itself public. The remote's push protection covers the residual case the local guard cannot see: a secret committed and then removed in a later commit, which still travels in the history.


    Ya kutosha kwa nishani!

    Wakati mradi umefanya utoaji, nyaraka za mradi LAZIMA zijumuishe miongozo ya watumiaji kwa utendaji wote wa kimsingi. [OSPS-DO-01.01]
    Unda miongozo ya watumiaji au nyaraka kwa utendaji wote wa kimsingi wa mradi, ikieleza jinsi ya kusakinisha, kusanidi, na kutumia vipengele vya mradi. Ikiwa kuna vitendo vinavyojulikana kuwa hatari au vya kuharibu, jumuisha maonyo yaliyo-wazi kabisa.

    README.md covers installation, configuration and use, opening with a two-minute quickstart. The docs/ directory holds ARCHITECTURE, API, CONFIGURATION (every environment variable, with the rule that a variable absent from the list does not exist), HOST-CONTRACT, MIGRATIONS, RETENTION and RELEASING, indexed by docs/README.md which routes the three audiences — integrators, operators, evaluators — to the right document. examples/ holds runnable integrations for standalone, Express and Vercel, pinned to the current version, with a CI guard that fails if they fall behind what main declares.


    Ya kutosha kwa nishani!

    Wakati mradi umefanya utoaji, nyaraka za mradi LAZIMA zijumuishe mwongozo wa kuripoti hitilafu. [OSPS-DO-02.01]
    Inashauriwa kwamba miradi itumie kifuatiliaji cha masuala cha chaguo-msingi cha VCS yao. Ikiwa chanzo cha nje kinatumiwa, hakikisha kwamba nyaraka za mradi na mwongozo wa kuchangia zinaeleza wazi na kwa uonekano jinsi ya kutumia mfumo wa kuripoti. Inashauriwa kwamba nyaraka za mradi pia ziweke matarajio ya jinsi hitilafu zitatolewa kipaumbele na kutatuliwa.

    SUPPORT.md states where each kind of report goes, what to include, and why — the version, the deployment shape, the exact URL that misbehaves, and what the server logged. Three issue forms exist: bug_report.yml, feature_request.yml and question.yml. Blank issues are disabled so every report arrives structured. .github/ISSUE_TEMPLATE/config.yml routes security reports away from the public tracker to the policy in SECURITY.md.


    Ya kutosha kwa nishani!

    Wakati ukiwa hai, mradi LAZIMA uwe na taratibu moja au zaidi za mijadala ya umma kuhusu mabadiliko yaliyopendekezwa na vizuizi vya matumizi. [OSPS-GV-02.01]
    Unda taratibu moja au zaidi za mijadala ya umma ndani ya mradi, kama orodha za barua, ujumbe wa papo hapo, au vifuatiliaji vya masuala, ili kuwezesha mawasiliano ya wazi na maoni.

    The public GitHub issue tracker, with a dedicated Question form alongside bug reports and feature requests, and public pull requests where proposed changes are discussed before merging. Both are open to anyone with a GitHub account. GitHub Discussions is deliberately disabled: the Question issue form serves that role, and .github/ISSUE_TEMPLATE/config.yml records why — the Discussions link previously produced a 404 for anyone who clicked it, from the very page that promises help.


    Ya kutosha kwa nishani!

    Wakati ukiwa hai, nyaraka za mradi LAZIMA zijumuishe maelezo ya mchakato wa kuchangia. [OSPS-GV-03.01]
    Unda CONTRIBUTING.md au saraka ya CONTRIBUTING/ ili kuainisha mchakato wa kuchangia ukijumuisha hatua za kuwasilisha mabadiliko, na kushirikiana na watunzaji wa mradi.

    CONTRIBUTING.md explains getting set up, running the test benches, what review looks for, how generated files are handled, signing the CLA, commit and branch conventions, and the project's one rule: a behaviour worth keeping is worth a test that fails without it. AGENTS.md records the conventions that are not evident from the file tree, marking which are enforced by a guard and which only by review. CLA.md states the contributor licence agreement, checked automatically on every pull request by .github/workflows/cla.yml.


    Ya kutosha kwa nishani!

    Wakati ukiwa hai, leseni kwa msimbo wa chanzo LAZIMA ikidhi Ufafanuzi wa Chanzo Wazi wa OSI au Ufafanuzi wa Programu Huria wa FSF. [OSPS-LE-02.01]
    Ongeza faili ya LICENSE kwenye hazina ya mradi na leseni ambayo ni leseni iliyoidhinishwa na Open Source Initiative (OSI), au leseni huria kama ilivyoidhinishwa na Free Software Foundation (FSF). Mifano ya leseni kama hizo ni pamoja na MIT, BSD 2-clause, BSD 3-clause revised, Apache 2.0, Lesser GNU General Public License (LGPL), na GNU General Public License (GPL). Kutolewa kwa umma kukidhi udhibiti huu ikiwa hakuna vizuizi vingine kama vile vimiliki.

    The source is licensed AGPL-3.0-or-later, which is both OSI-approved and classified as free by the FSF. One file is deliberately different: src/bridge.ts, the message contract a host application imports to talk to the player, is MIT — also OSI-approved and FSF-free — so that integrating with the player is not itself encumbered. Both licences meet the definition.


    Ya kutosha kwa nishani!

    Wakati ukiwa hai, leseni kwa mali za programu iliyotolewa LAZIMA ikidhi Ufafanuzi wa Chanzo Wazi wa OSI au Ufafanuzi wa Programu Huria wa FSF. [OSPS-LE-02.02]
    Ikiwa leseni tofauti imejumuishwa na mali za programu zilizotolewa, hakikisha ni leseni iliyoidhinishwa na Open Source Initiative (OSI), au leseni huria kama ilivyoidhinishwa na Free Software Foundation (FSF). Mifano ya leseni kama hizo ni pamoja na MIT, BSD 2-clause, BSD 3-clause revised, Apache 2.0, Lesser GNU General Public License (LGPL), na GNU General Public License (GPL). Kumbuka kwamba leseni kwa mali za programu zilizotolewa inaweza kuwa tofauti na msimbo wa chanzo.

    The released assets carry the same licences as the source: package.json declares "license": "AGPL-3.0-or-later", and no separate or additional licence applies to the published npm package, the container image, or the GitHub Release archives. Both AGPL-3.0-or-later and the MIT licence covering src/bridge.ts are OSI-approved and FSF-free.


    Ya kutosha kwa nishani!

    Wakati ukiwa hai, leseni kwa msimbo wa chanzo LAZIMA itunzwe katika faili ya LICENSE ya hazina inayohusiana, faili ya COPYING, au saraka ya LICENSE/. [OSPS-LE-03.01]
    Jumuisha leseni ya msimbo wa chanzo wa mradi katika faili ya LICENSE ya mradi, faili ya COPYING, au saraka ya LICENSE/ ili kutoa uonekano na uwazi juu ya masharti ya leseni. Jina la faili LINAWEZA kuwa na kiendelezi. Ikiwa mradi una hazina nyingi, hakikisha kwamba kila hazina inajumuisha faili ya leseni.

    LICENSE at the repository root holds the full text of the GNU Affero General Public License v3. LICENSE-MIT, alongside it, holds the MIT text covering src/bridge.ts. The project is a single repository, so both files sit at the top level of the only codebase, and README.md links to each from its Licence section.


    Ya kutosha kwa nishani!

    Wakati mradi ukiwa hai, leseni kwa rasilimali za programu iliyotolewa LAZIMA ijumuishwe ndani ya msimbo wa chanzo uliotolewa, au katika faili ya LICENSE, faili ya COPYING, au saraka ya LICENSE/ pembeni na rasilimali za toleo linalohusiana. [OSPS-LE-03.02]
    Jumuisha leseni ya rasilimali za programu zilizotolewa za mradi katika msimbo wa chanzo uliotolewa, au katika faili ya LICENSE, faili ya COPYING, au saraka ya LICENSE/ pembeni na rasilimali za toleo linalohusiana ili kutoa mwonekano na uwazi wa masharti ya leseni. Jina la faili YAWEZA kuwa na kiendelezi. Ikiwa mradi una hazina nyingi, hakikisha kwamba kila hazina inajumuisha faili ya leseni.

    The files array in package.json lists LICENSE and LICENSE-MIT explicitly, so both are inside every published npm tarball alongside the release assets. Each GitHub Release is cut from a tag whose tree contains both files at the root, and the container image is built from that same tree.


    Ya kutosha kwa nishani!

    Wakati mradi ukiwa hai, hazina ya msimbo wa chanzo wa mradi LAZIMA iweze kusomwa hadharani kwenye URL isiyobadilika. [OSPS-QA-01.01]
    Tumia VCS ya kawaida kama GitHub, GitLab, au Bitbucket. Hakikisha hazina inaweza kusomwa hadharani. Epuka kunakili au kuakisi hazina isipokuwa nyaraka zinazoonekana sana zinatoa wazi chanzo kikuu. Epuka mabadiliko ya mara kwa mara kwenye hazina ambayo ingeathiri URL ya hazina. Hakikisha hazina ni ya umma.

    The repository is publicly readable without an account at the static URL https://github.com/Juli1artha/discovery-media-player. It is the single authoritative source; there is no mirror or duplicate to create ambiguity about which copy is primary, and the URL has not changed.


    Ya kutosha kwa nishani!

    Mfumo wa udhibiti wa toleo LAZIMA uwe na kumbukumbu inayoweza kusomwa hadharani ya mabadiliko yote yaliyofanywa, nani alifanya mabadiliko, na mabadiliko yalifanywa lini. [OSPS-QA-01.02]
    Tumia VCS ya kawaida kama GitHub, GitLab, au Bitbucket ili kudumisha historia ya kuwasilisha inayoweza kusomwa hadharani. Epuka kusonga au kuandika upya miwasilisho kwa namna ambayo ingeweza kuficha mwandishi wa miwasilisho yoyote.

    The full git history is public and complete. Every commit carries its author and timestamp, and every change lands through a pull request whose number is in the commit subject, so the discussion behind a change is reachable from the change itself. History on main is never rewritten: force-pushing is not part of the workflow, and a pre-push hook refuses pushes to a branch whose pull request has already been merged, precisely so that work cannot silently detach from the recorded history.


    Ya kutosha kwa nishani!

    Wakati mfumo wa usimamizi wa kifurushi unaposaidia, hazina ya msimbo wa chanzo LAZIMA iwe na orodha ya utegemezi inayohesabu utegemezi wa moja kwa moja wa lugha. [OSPS-QA-02.01]
    Hii inaweza kuwa kwa namna ya faili ya usimamizi wa kifurushi au faili ya utegemezi wa lugha inayoorodhesha utegemezi wote wa moja kwa moja kama package.json, Gemfile, au go.mod.

    package.json enumerates every direct dependency: one runtime dependency, pdfjs-dist, pinned to an exact version because it is the rendering engine and its upgrade is a decision rather than a routine bump, plus the development toolchain. package-lock.json is committed, so the full transitive graph is resolved and reproducible from a clean npm ci. Dependabot watches three ecosystems — npm, GitHub Actions and Docker — with major upgrades deliberately separated from patches so a major cannot hide inside a grouped pull request.


    Ya kutosha kwa nishani!

    Wakati mradi ukiwa hai, nyaraka za mradi LAZIMA ziwe na orodha ya hazina zozote za msimbo zinazozingatiwa kama miradi midogo. [OSPS-QA-04.01]
    Weka kwenye nyaraka hazina zozote za ziada za msimbo wa miradi midogo zinazozalishwa na mradi na kukusanywa katika toleo. Nyaraka hii inapaswa kujumuisha hali na nia ya hazina ya msimbo husika.

    Not applicable: the project is a single repository. No subproject codebase is compiled into a release, and nothing outside https://github.com/Juli1artha/discovery-media-player contributes source to the published package or container image, so there is no list of codebases to document.


    Ya kutosha kwa nishani!

    Wakati mradi ukiwa hai, mfumo wa udhibiti wa toleo LAZIMA USIWE na vitu vilivyozalishwa vinavyoweza kutekelezwa. [OSPS-QA-05.01]
    Ondoa vitu vilivyozalishwa vinavyoweza kutekelezwa katika mfumo wa udhibiti wa toleo wa mradi. Inashauriwa kwamba hali yoyote ambapo kifaa kilichozalishwa kinachoweza kutekelezwa kinaonekana muhimu kwa mchakato kama vile majaribio, badala yake kinapaswa kuzalishwa wakati wa ujenzi au kuhifadhiwa kando na kuchukuliwa wakati wa hatua maalum ya mfumo wa kuendeshea iliyoandikwa vizuri.

    Every tracked file was checked by content type. The only binary is examples/demo/documents/sample.pdf, a 2 KB sample document that exists so the demo has something to display — a content asset of exactly the kind this control excludes, not an application binary or a library. There are no executables, archives, object files or compiled libraries anywhere in version control.


    Ya kutosha kwa nishani!

    Wakati mradi ukiwa hai, mfumo wa udhibiti wa toleo LAZIMA USIWE na vitu vya binary visivyoweza kukaguliwa. [OSPS-QA-05.02]
    Usiongeze vitu vyovyote vya binary visivyoweza kukaguliwa katika mfumo wa udhibiti wa toleo wa mradi. Hii inajumuisha programu za binary za maombi, faili za maktaba, na vitu sawa. Haijumuishi mali kama picha za kigraphiki, faili za sauti au muziki, na maudhui sawa ambayo kwa kawaida huhifadhiwa katika muundo wa binary.

    No compiled or executable artifact is committed. Two generated files are tracked — server/browser.generated.js and server/shared.generated.js, about 23 KB of plain JavaScript in total — because the serverless targets this player is designed for build nothing at deploy time. They are human-readable text that diffs normally in review, each carries a header naming the TypeScript sources it was produced from, and CI rebuilds them on every run and fails if the result differs by a byte from what is committed. A committed bundle therefore cannot diverge from the source it claims to come from, which is the risk this control exists to prevent.


    Ya kutosha kwa nishani!

    Wakati mradi ukiwa hai, nyaraka za mradi LAZIMA ziwe na anwani za kuwasiliana za usalama. [OSPS-VM-02.01]
    Unda faili ya security.md (au inayoitwa sawa) inayohifadhi anwani za kuwasiliana za usalama kwa mradi.

    The project offers two private reporting channels, and SECURITY.md documents both: GitHub private vulnerability reporting (the repository's Security tab, "Report a vulnerability") and the direct address security@3d-discovery.fr — with an acknowledgement within 72 hours and an assessment within 7 days. The issue-template chooser points reporters to the private form before anything public. https://github.com/Juli1artha/discovery-media-player/blob/main/SECURITY.md



Data hii inapatikana chini ya Community Data License Agreement – Permissive, Version 2.0 (CDLA-Permissive-2.0). Hii inamaanisha kuwa Mpokeaji wa Data anaweza kushiriki Data, na au bila marekebisho, mradi Mpokeaji wa Data anapatanisha maandishi ya mkataba huu na Data iliyoshirikiwa. Tafadhali tambua Julien Arthapignet na wachangiaji wa nishani ya Mazoea Bora ya OpenSSF.

Ingizo la nishani ya mradi linamilikiwa na: Julien Arthapignet.
Ingizo liliundwa siku 2026-08-22 00:19:58 UTC, iliyosasishwa mara ya mwisho siku 2026-08-25 12:37:10 UTC. Ilipata mara ya mwisho nishani ya kupita siku 2026-08-22 07:59:01 UTC.