[Security Self-Assessment] Linkerd

[amanda-gonzalez]

Details

Project Name: Linkerd

Github URL: https://github.com/linkerd

CNCF project stage: Graduated

Sandbox Proposal: Linkerd Sandbox Proposal
Incubation Proposal: Linkerd Incubation Proposal
Graduation Proposal: Linkerd Graduation Proposal
Security Provider: <Yes / No>

Self-assessment link (before PR): Linkerd Security Self-Assessment

Tasks

• Stage 1: Preparation

  • Create a GitHub issue for the security self assessment of CloudEvents project.
    • Issue Link in CNCF Tag-Security: [Security Self-Assessment] Linkerd #21)
  • Create a place holder of security self assessment.
    • Create a fork of the CNCF Tag-Security in your Github.
    • Create a new folder for the CloudEvents project.
    • Add the security self assessment template under the project folder.
    • Issue link of Initial Commit: amanda-gonzalez/tag-security@ffa5cc5
  • Review Documentation of the CloudEvents project.

• Stage 2: Understand the Project Landscape

  • Understand the overall project at a sufficient level of detail.
  • Update overview section
    • Background
      commit: amanda-gonzalez/tag-security@7e2c310
    • Actors
      commit: amanda-gonzalez/tag-security@7e2c310
    • Actions
      commit: amanda-gonzalez/tag-security@7e2c310
    • Goals
      commit: amanda-gonzalez/tag-security@7e2c310
    • Non-Goals
      commit: amanda-gonzalez/tag-security@7e2c310

• Stage 3: First complete draft of the Self Assessment

  • Document technical specifications of the CloudEvents project.
    • Self assessment use
      commit: amanda-gonzalez/tag-security@0f8ceaa
    • Security functions and features
      commit: amanda-gonzalez/tag-security@806abb7
    • Project compliance
      commit: amanda-gonzalez/tag-security@bae30ca
    • Secure development practices
      commit: amanda-gonzalez/tag-security@c4b47fe
    • Security issue resolution
      commit: amanda-gonzalez/tag-security@2f53d5e
    • Appendix
      commit: amanda-gonzalez/tag-security@2f53d5e
  • Complete the security self assessment draft.

• Stage 4: Iteration with the project

  • Initiate discussion with CloudEvents project maintainers.
  • Incorporate inputs and feedback from CloudEvents project maintainers.
  • Document the findings.

• Stage 5: Finalization

  • Initiate PR
  • Get feedback and findings from reviewers
  • Fix the findings
  • Merge the PR
  • Close the issue