Google and OpenSSF have launched a new application called Allstar, which provides the automated continuous application of best security practices for GITHUB projects.
As a member of the open source software community (OSS), the search giant is very aware of the growing threat posed by the attacks of the software supply chain against open source projects and AllStar is its last effort to improve your safety.
With AllStar, GITHUB project owners can verify the adherence of the security policy, establish desired compliance actions and continuously enact these applications when A setting or file change is activated in the organization or project repository according to a New blog publication from OpenSff.
We have built a list of the best portable computers for programming.
These are the best Firewall solutions in the market.
Also check out our list of best endpoint protection software.
When using this new GITHUB application, the open source community can proactively reduce the risk of security while adding the least possible friction to its workflows.
AllStar application
Allstar is a Google partner and the OpenSff automated tool scoring cards that evaluate the risks for a repository and its dependencies.
While security scorecards verify a series of important heuristics to provide a score to help users understand specific areas to improve their projects’ safety posture, AllStar allows maintainers to opt for automated execution of Specific controls. However, if a repository fails an enabled verification, AllStar intervenes to make the necessary changes to remedy the problem.
AllStar itself works by continuously verifying the GitHub API states and repository file content, such as repository configuration, branch configuration and workflow configuration against defined security policies and actions application of compliance (presentation problems, changing the configuration) when the expected states do not coincide with the policies.
Although OpenSff runs its own instance of AllStar that anyone can install and use, GITHUB project owners can also create and execute their own cases for safety or personalization reasons.
To start with AllStar, GITHUB project owners can install the AllStar application here and use these quick start instructions to configure it.
