Add security documentation for OpenSSF Silver badge#7896
Merged
yurishkuro merged 3 commits intojaegertracing:mainfrom Jan 18, 2026
Merged
Add security documentation for OpenSSF Silver badge#7896yurishkuro merged 3 commits intojaegertracing:mainfrom
yurishkuro merged 3 commits intojaegertracing:mainfrom
Conversation
![graphite-app[bot]](https://avatars.githubusercontent.com/in/158384?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds comprehensive security documentation to support the OpenSSF Best Practices Silver badge application. The documentation provides detailed threat modeling, security assurance, and operational guidance for the Jaeger distributed tracing system.
Changes:
- Added five new security documentation files covering threat model, assurance case, security architecture, self-assessment, and release verification
- Updated SECURITY.md with a table linking to the new security documentation
- Updated SECURITY-INSIGHTS.yml metadata with current dates and additional self-assessment reference
- Enhanced CONTRIBUTING.md with explicit testing policy statement
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| docs/security/verifying-releases.md | Provides instructions for verifying GPG signatures on releases and git tags |
| docs/security/threat-model.md | Documents threat actors, trust boundaries, and security mitigations across the system |
| docs/security/self-assessment.md | CNCF TAG Security self-assessment summary with metadata |
| docs/security/assurance-case.md | Maps security requirements to design principles and common weakness mitigations |
| docs/security/architecture.md | Details TLS configuration, input validation, and system hardening practices |
| SECURITY.md | Added Security Documentation section with table of links to new documentation |
| SECURITY-INSIGHTS.yml | Updated timestamps and added local self-assessment reference |
| CONTRIBUTING.md | Added explicit testing policy statement requiring tests for new functionality |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This PR adds comprehensive security documentation required for the OpenSSF Best Practices Silver badge. New security documentation (docs/security/): - assurance-case.md: Security assurance case, trust boundaries, and CWE mitigations - architecture.md: TLS/crypto practices, input validation, and hardening - threat-model.md: Detailed threat analysis and mitigations - verifying-releases.md: User instructions for verifying release signatures - self-assessment.md: Local copy of Jaeger's CNCF TAG Security self-assessment Updated files: - SECURITY.md: Linked new security documentation - CONTRIBUTING.md: Added formal test policy statement - SECURITY-INSIGHTS.yml: Updated security metadata and links Signed-off-by: Jonah Kowall <jkowall@kowall.net>
jkowall
force-pushed
the
openssf-silver-badge-docs-v3
branch
from
d70d277 to
a02c0fb
Compare
- Fixed typos: OLP -> OTLP and GRPC -> gRPC - Updated TLS guidance to emphasize TLS 1.2+ and warn against deprecated versions Signed-off-by: Jonah Kowall <jkowall@kowall.net>
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 8 out of 8 changed files in this pull request and generated 5 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Added container image verification guidance - Updated self-assessment evidence URLs - Fixed OpenSSF branding in threat model - Clarified TLS production requirements in assurance case - Normalized testing policy language in CONTRIBUTING.md Signed-off-by: Jonah Kowall <jkowall@kowall.net>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #7896 +/- ##
==========================================
+ Coverage 95.44% 95.45% +0.01%
==========================================
Files 305 305
Lines 16192 16192
==========================================
+ Hits 15454 15456 +2
+ Misses 577 576 -1
+ Partials 161 160 -1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Metrics Comparison SummaryTotal changes across all snapshots: 0 Detailed changes per snapshotsummary_metrics_snapshot_cassandra📊 Metrics Diff SummaryTotal Changes: 0
summary_metrics_snapshot_cassandra📊 Metrics Diff SummaryTotal Changes: 0
summary_metrics_snapshot_cassandra📊 Metrics Diff SummaryTotal Changes: 0
summary_metrics_snapshot_cassandra📊 Metrics Diff SummaryTotal Changes: 0
|
yurishkuro
approved these changes
Jan 18, 2026
Manik2708
pushed a commit
to Manik2708/jaeger
that referenced
this pull request
Jan 20, 2026
This PR adds comprehensive security documentation required for the OpenSSF Best Practices Silver badge. Documentation is organized in `docs/security/` and includes: - Security Assurance Case - Security Architecture - Threat Model - Release Verification Guide - Self-Assessment Minimal updates were made to `SECURITY.md`, `CONTRIBUTING.md`, and `SECURITY-INSIGHTS.yml` to link these documents. Built on a fresh branch from `upstream/main` to ensure no stale changes persist. --------- Signed-off-by: Jonah Kowall <jkowall@kowall.net>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR adds comprehensive security documentation required for the OpenSSF Best Practices Silver badge.
Documentation is organized in
docs/security/and includes:Minimal updates were made to
SECURITY.md,CONTRIBUTING.md, andSECURITY-INSIGHTS.ymlto link these documents.Built on a fresh branch from
upstream/mainto ensure no stale changes persist.