Using OpenSSF's Allstar to Secure Your Organizations GitHub Repositories
Talkat Open Source Summit North America 2022 · on Wednesday, 2022-06-22· at 14:35· Room 301/302 (Level 3), JW Marriott Austin, 110 E 2nd Street Austin, TX 78701·
summary
OpenSSF Allstar is a GitHub App that continuously scans org repositories for concrete risks and enforces policies like branch protection, binary artifacts prohibition and presence of security.md, using Security Scorecards as additional checks. It opens one GitHub issue per policy violation, and can auto-fix branch protection settings via the GitHub API. It runs as a hosted instance or self-hosted binary; Google reports enabling it across teams (Flutter, Dart, Angular) and enabling only the binary-artifact check org-wide during phased rollout.
AI-written summary · about
chapters (6)
- 0:00Start
- 2:51Nightmare scenario
- 14:34Branch Protection
- 15:19Binary Artifacts
- 20:40Security Scorecards Checks
- 28:54Case Study: Google
related talks
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
25mHow do you trust your open source software?
40mOpenSSF Scorecards for Dart and Flutter projects
31mScorecard at Scale: Old and New Possibilities for Lifting Security on All Repositories
42mDeveloping a Secure, Open Future
27mHow Do You Trust Your Open Source Software?
39mA Guide to Securing GitHub Based on Lessons Learned