Skip to content

Commit 2f6ad24

Browse files
martincostellomartincostello
authored
[Repo] OpenSSF Security Insights v2 (#7143)
1 parent 989dd3c commit 2f6ad24

1 file changed

Lines changed: 139 additions & 121 deletions

File tree

‎SECURITY-INSIGHTS.yml‎

Lines changed: 139 additions & 121 deletions
Original file line numberDiff line numberDiff line change
@@ -1,126 +1,144 @@
11
header:
2-
schema-version: '1.0.0'
3-
expiration-date: '2027-02-14T00:00:00.000Z'
4-
last-updated: '2026-02-14'
5-
last-reviewed: '2026-02-14'
6-
project-url: https://github.com/open-telemetry/opentelemetry-dotnet
7-
changelog: https://github.com/open-telemetry/opentelemetry-dotnet/blob/main/RELEASENOTES.md
8-
license: https://github.com/open-telemetry/opentelemetry-dotnet/blob/main/LICENSE.TXT
9-
10-
project-lifecycle:
11-
status: active
12-
bug-fixes-only: false
13-
core-maintainers:
14-
- https://github.com/alanwest
15-
- https://github.com/cijothomas
16-
- https://github.com/CodeBlanch
17-
- https://github.com/Kielek
18-
- https://github.com/martincostello
19-
- https://github.com/rajkumar-rangaraj
20-
21-
contribution-policy:
22-
accepts-pull-requests: true
23-
accepts-automated-pull-requests: true
24-
contributing-policy: https://github.com/open-telemetry/opentelemetry-dotnet/blob/main/CONTRIBUTING.md
25-
code-of-conduct: https://github.com/open-telemetry/.github/blob/main/CODE_OF_CONDUCT.md
26-
automated-tools-list:
27-
- automated-tool: renovatebot
28-
action: allowed
29-
comment: Automated dependency updates are accepted.
30-
31-
documentation:
32-
- https://opentelemetry.io/docs/languages/dotnet/
33-
34-
distribution-points:
35-
- pkg:nuget/OpenTelemetry
36-
- pkg:nuget/OpenTelemetry.Api
37-
- pkg:nuget/OpenTelemetry.Api.ProviderBuilderExtensions
38-
- pkg:nuget/OpenTelemetry.Exporter.Console
39-
- pkg:nuget/OpenTelemetry.Exporter.InMemory
40-
- pkg:nuget/OpenTelemetry.Exporter.OpenTelemetryProtocol
41-
- pkg:nuget/OpenTelemetry.Exporter.Prometheus.AspNetCore
42-
- pkg:nuget/OpenTelemetry.Exporter.Prometheus.HttpListener
43-
- pkg:nuget/OpenTelemetry.Exporter.Zipkin
44-
- pkg:nuget/OpenTelemetry.Extensions.Hosting
45-
- pkg:nuget/OpenTelemetry.Extensions.Propagators
46-
- pkg:nuget/OpenTelemetry.Shims.OpenTracing
47-
48-
security-artifacts:
49-
threat-model:
50-
threat-model-created: false
51-
comment: |
52-
No formal threat model created yet.
53-
self-assessment:
54-
self-assessment-created: false
55-
comment: |
56-
No formal self-assessment yet.
57-
58-
security-contacts:
59-
- type: website
60-
value: https://github.com/open-telemetry/opentelemetry-dotnet/security
61-
primary: true
62-
- type: email
63-
value: security@opentelemetry.io
64-
primary: false
65-
- type: email
66-
value: cncf-opentelemetry-security@lists.cncf.io
67-
primary: false
2+
last-reviewed: '2026-04-23'
3+
last-updated: '2026-04-23'
4+
schema-version: 2.0.0
5+
url: https://github.com/open-telemetry/opentelemetry-dotnet/blob/main/SECURITY-INSIGHTS.yml
6+
comment: |
7+
This file contains the minimum information for https://github.com/open-telemetry/opentelemetry-dotnet.
688
69-
security-testing:
70-
- tool-type: sca
71-
tool-name: Renovate
72-
tool-version: latest
73-
tool-url: https://docs.renovatebot.com/
74-
tool-rulesets:
75-
- built-in
76-
integration:
77-
ad-hoc: false
78-
ci: true
79-
before-release: true
80-
comment: |
81-
Automated dependency updates.
82-
- tool-type: fuzzing
83-
tool-name: FsCheck
84-
tool-version: latest
85-
tool-url: https://fscheck.github.io/FsCheck/
86-
tool-rulesets:
87-
- default
88-
integration:
89-
ad-hoc: false
90-
ci: true
91-
before-release: false
9+
project:
10+
name: OpenTelemetry .NET
11+
homepage: https://opentelemetry.io/docs/languages/dotnet/
12+
administrators:
13+
- name: Alan West
14+
affiliation: New Relic
15+
social: https://github.com/alanwest
16+
primary: true
17+
- name: Martin Costello
18+
affiliation: Grafana Labs
19+
social: https://github.com/martincostello
20+
- name: "Piotr Kie\u0142kowicz"
21+
affiliation: Splunk
22+
social: https://github.com/Kielek
23+
- name: Rajkumar Rangaraj
24+
affiliation: Microsoft
25+
social: https://github.com/rajkumar-rangaraj
26+
documentation:
27+
code-of-conduct: https://github.com/open-telemetry/.github/blob/main/CODE_OF_CONDUCT.md
28+
detailed-guide: https://opentelemetry.io/docs/languages/dotnet/
29+
quickstart-guide: https://opentelemetry.io/docs/languages/dotnet/getting-started/
30+
release-process: https://github.com/open-telemetry/opentelemetry-dotnet/blob/main/build/RELEASING.md
31+
signature-verification: https://github.com/open-telemetry/opentelemetry-dotnet/blob/main/README.md#digital-signing
32+
repositories:
33+
- name: opentelemetry-dotnet
34+
url: https://github.com/open-telemetry/opentelemetry-dotnet
35+
comment: |
36+
The OpenTelemetry .NET Client repository.
37+
vulnerability-reporting:
38+
bug-bounty-available: false
39+
reports-accepted: true
40+
policy: https://opentelemetry.io/docs/security/security-response/
41+
contact:
42+
name: The OpenTelemetry security team
43+
email: security@opentelemetry.io
44+
primary: true
9245
comment: |
93-
FsCheck is used for fuzz testing as part of CI.
94-
- tool-type: sast
95-
tool-name: CodeQL
96-
tool-version: latest
97-
tool-url: https://github.com/github/codeql
98-
tool-rulesets:
99-
- default
100-
integration:
101-
ad-hoc: false
102-
ci: true
103-
before-release: true
104-
comment: |
105-
CodeQL static analysis is run in CI for all commits and pull requests to detect security vulnerabilities.
46+
Report security vulnerabilities via https://github.com/open-telemetry/opentelemetry-dotnet/security.
10647
107-
vulnerability-reporting:
108-
accepts-vulnerability-reports: true
109-
email-contact: security@opentelemetry.io
110-
security-policy: https://opentelemetry.io/docs/security/security-response/
111-
bug-bounty-available: false
112-
comment: |
113-
Report security vulnerabilities via https://github.com/open-telemetry/opentelemetry-dotnet/security.
48+
repository:
49+
url: https://github.com/open-telemetry/opentelemetry-dotnet
50+
status: active
51+
accepts-automated-change-request: true
52+
accepts-change-request: true
53+
bug-fixes-only: false
54+
no-third-party-packages: false
55+
core-team:
56+
- name: Alan West
57+
affiliation: New Relic
58+
social: https://github.com/alanwest
59+
primary: true
60+
- name: Cijo Thomas
61+
affiliation: Microsoft
62+
social: https://github.com/cijothomas
63+
- name: Martin Costello
64+
affiliation: Grafana Labs
65+
social: https://github.com/martincostello
66+
- name: Mikel Blanchard
67+
affiliation: Microsoft
68+
social: https://github.com/CodeBlanch
69+
- name: "Piotr Kie\u0142kowicz"
70+
affiliation: Splunk
71+
social: https://github.com/Kielek
72+
- name: Rajkumar Rangaraj
73+
affiliation: Microsoft
74+
social: https://github.com/rajkumar-rangaraj
75+
documentation:
76+
contributing-guide: https://github.com/open-telemetry/opentelemetry-dotnet/blob/main/CONTRIBUTING.md
77+
dependency-management-policy: https://github.com/open-telemetry/opentelemetry-dotnet/blob/main/.github/renovate.json
78+
security-policy: https://opentelemetry.io/docs/security/security-response/
79+
license:
80+
expression: Apache-2.0
81+
url: https://github.com/open-telemetry/opentelemetry-dotnet/blob/main/LICENSE.TXT
82+
release:
83+
automated-pipeline: true
84+
changelog: https://github.com/open-telemetry/opentelemetry-dotnet/blob/main/RELEASENOTES.md
85+
distribution-points:
86+
- uri: https://www.nuget.org/packages/OpenTelemetry
87+
comment: OpenTelemetry NuGet package distributed from NuGet.org.
88+
- uri: https://www.nuget.org/packages/OpenTelemetry.Api
89+
comment: OpenTelemetry.Api NuGet package distributed from NuGet.org.
90+
- uri: https://www.nuget.org/packages/OpenTelemetry.Api.ProviderBuilderExtensions
91+
comment: OpenTelemetry.Api.ProviderBuilderExtensions NuGet package distributed from NuGet.org.
92+
- uri: https://www.nuget.org/packages/OpenTelemetry.Exporter.Console
93+
comment: OpenTelemetry.Exporter.Console NuGet package distributed from NuGet.org.
94+
- uri: https://www.nuget.org/packages/OpenTelemetry.Exporter.InMemory
95+
comment: OpenTelemetry.Exporter.InMemory NuGet package distributed from NuGet.org.
96+
- uri: https://www.nuget.org/packages/OpenTelemetry.Exporter.OpenTelemetryProtocol
97+
comment: OpenTelemetry.Exporter.OpenTelemetryProtocol NuGet package distributed from NuGet.org.
98+
- uri: https://www.nuget.org/packages/OpenTelemetry.Exporter.Prometheus.AspNetCore
99+
comment: OpenTelemetry.Exporter.Prometheus.AspNetCore NuGet package distributed from NuGet.org.
100+
- uri: https://www.nuget.org/packages/OpenTelemetry.Exporter.Prometheus.HttpListener
101+
comment: OpenTelemetry.Exporter.Prometheus.HttpListener NuGet package distributed from NuGet.org.
102+
- uri: https://www.nuget.org/packages/OpenTelemetry.Exporter.Zipkin
103+
comment: OpenTelemetry.Exporter.Zipkin NuGet package distributed from NuGet.org.
104+
- uri: https://www.nuget.org/packages/OpenTelemetry.Extensions.Hosting
105+
comment: OpenTelemetry.Extensions.Hosting NuGet package distributed from NuGet.org.
106+
- uri: https://www.nuget.org/packages/OpenTelemetry.Extensions.Propagators
107+
comment: OpenTelemetry.Extensions.Propagators NuGet package distributed from NuGet.org.
108+
- uri: https://www.nuget.org/packages/OpenTelemetry.Shims.OpenTracing
109+
comment: OpenTelemetry.Shims.OpenTracing NuGet package distributed from NuGet.org.
110+
attestations:
114111

115-
dependencies:
116-
third-party-packages: true
117-
dependencies-lists:
118-
- https://github.com/open-telemetry/opentelemetry-dotnet/blob/main/Directory.Packages.props
119-
dependencies-lifecycle:
120-
policy-url: https://github.com/open-telemetry/opentelemetry-dotnet/blob/main/.github/renovate.json
121-
comment: |
122-
Dependencies are kept up to date by Renovate.
123-
env-dependencies-policy:
124-
policy-url: https://github.com/open-telemetry/opentelemetry-dotnet/blob/main/.github/renovate.json
125-
comment: |
126-
Dependencies are kept up to date by Renovate.
112+
security:
113+
assessments:
114+
self:
115+
evidence: https://github.com/open-telemetry/opentelemetry-dotnet/pull/7143
116+
date: '2026-04-23'
117+
tools:
118+
- name: CodeQL
119+
comment: |
120+
Static code analysis.
121+
integration:
122+
adhoc: true
123+
ci: true
124+
release: true
125+
rulesets: https://github.com/open-telemetry/opentelemetry-dotnet/blob/main/.github/workflows/codeql-analysis.yml
126+
type: sast
127+
- name: FsCheck
128+
comment: |
129+
FsCheck is used for fuzz testing as part of CI.
130+
integration:
131+
adhoc: true
132+
ci: true
133+
release: true
134+
rulesets: default
135+
type: fuzzing
136+
- name: Renovate
137+
comment: |
138+
Automated dependency updates.
139+
integration:
140+
adhoc: true
141+
ci: true
142+
release: true
143+
rulesets: https://github.com/open-telemetry/opentelemetry-dotnet/blob/main/.github/renovate.json
144+
type: sca

0 commit comments

Comments
 (0)