OpenSSF Best Practices Badge — Silver

[asmit27rai]

Current Status

KubeArmor currently holds the Passing level badge from the OpenSSF Best Practices program, which corresponds to a score of 5/10 on the OpenSSF Scorecard's CII-Best-Practices check.

Badge progress on bestpractices.dev is currently at:

• Passing: 100% complete
• Silver: 82% complete
• Gold: 65% complete

This discussion outlines what remains to complete Silver, so the score improves from 5 to 7 on Scorecard.

Badge dashboard: [Dashboard](https://www.bestpractices.dev/en/projects/5401/silver)

Items That Still Need Work

The following criteria are currently unanswered and need to be addressed before Silver can be reached.

Access continuity if a maintainer becomes unavailable. This is a MUST requirement. The project needs a short section in GOVERNANCE.md confirming that more than one person holds admin access to the repository and organization, and that releases can continue within a week if one maintainer is unavailable.

Bus factor of two or more. This is a SHOULD requirement. The MAINTAINERS or OWNERS file should be checked and linked as evidence if it already lists two or more active maintainers.

Accessibility best practices. This is a SHOULD requirement. Since KubeArmor is a backend security enforcement tool without a graphical interface, this can likely be marked as not applicable with a short justification.

Internationalization. This is a SHOULD requirement. Since the project does not generate localized user-facing text, this can likely be marked as not applicable with a short justification.

External dependencies listed in a computer-processable way. This is a MUST requirement. This is already satisfied through go.mod and go.sum, and just needs to be linked as evidence.

Dependency monitoring for known vulnerabilities. This is a MUST requirement. The project needs to confirm whether Dependabot or Renovate is currently enabled. If not, a dependabot configuration file needs to be added for Go modules and GitHub Actions.

Ease of updating reused or externally maintained components. This is a MUST requirement. This is already satisfied by the standard Go module system and just needs to be marked accordingly.

Avoiding deprecated or obsolete APIs. This is a SHOULD requirement. If static analysis such as go vet or staticcheck already runs in CI, that workflow can be linked as evidence.

Automated test suite coverage of at least 80% of statements. This is a MUST requirement and the most significant gap. Current coverage needs to be measured, and additional unit tests are likely required to close the gap. Integrating a coverage reporting tool into CI is recommended so progress can be tracked publicly.

Input validation for untrusted inputs. This is a MUST requirement. This maps to validation of KubeArmorPolicy inputs. Existing validation logic, whether through CRD schema validation or Go-level checks, needs to be identified and linked as evidence.

Future Work

Once Silver is fully completed, the project can begin evaluating Gold criteria as a follow-up milestone. Gold requires a higher bar, including involvement from multiple independent contributors across different organizations, reproducible builds, all releases being cryptographically signed, and stricter automated test coverage thresholds enforced in CI. Progress toward Gold is currently at 65% and will be tracked in a separate discussion once Silver is achieved.

CCing: @Aryan-sharma11 @rootxrishabh

[Aryan-sharma11]

cc @achrefbensaad @AryanBakliwal

[asmit27rai]

OpenSSF Best Practices Silver Badge

I have added the remaining repository governance, security policy, and SLSA Level 3 provenance documentation in Commit of PR#2839 to bring KubeArmor's OpenSSF Best Practices Silver Badge from 82% to 100%.

---

Key Changes in PR #2839

1. Access Continuity & Bus Factor (GOVERNANCE.md):

2. Input Validation & Secure Design (SECURITY.md):

3. Release Governance (RELEASES.md):

   • Already in main branch.

4. Contributor Guidelines & DCO (CONTRIBUTING.md):

   • Already in main branch.

5. SLSA Level 3 Provenance & Continuous Verification Workflows:

   • Added reusable SLSA container provenance generator jobs (provenance, provenance-init, provenance-controller) in .github/workflows/ci-latest-release.yml.

---

Action Item for Maintainers

Once PR #2839 is merged, the project maintainers can update the corresponding criteria on the OpenSSF BadgeApp Portal to achieve 100% Silver Badge Status:

Criteria ID	Status	Reference URL / Evidence
access_continuity	Met	GOVERNANCE.md#access-continuity-and-bus-factor
bus_factor	Met	MAINTAINERS.md
accessibility_best_practices	Met	https://docs.kubearmor.io
internationalization	N/A	Backend system daemon / CLI tool
external_dependencies	Met	KubeArmor/go.mod
dependency_monitoring	Met	renovate.json
updateable_reused_components	Met	renovate.json
interfaces_current	Met	KubeArmor/go.mod
test_statement_coverage80	Met	https://codecov.io/gh/kubearmor/KubeArmor
input_validation	Met	SECURITY.md#input-validation-and-secure-design

CCing: @achrefbensaad @Aryan-sharma11 @AryanBakliwal @rootxrishabh