Audit repositories for security tools

[codeboten]

Get a questionnaire to SIGs in the org asking them what tools are enabled in their repos:

• open-telemetry/.github
• open-telemetry/assign-reviewers-action
• [security] audit repository tooling build-tools#212
• [security] audit repository tooling #71
• open-telemetry/docs-cn
• open-telemetry/docs-ja
• [security] audit repository tooling opamp-go#208
• [security] audit repository tooling opamp-java#9
• open-telemetry/opamp-spec
• [security] audit repository tooling opentelemetry-android#126
• open-telemetry/opentelemetry-collector
• open-telemetry/opentelemetry-collector-builder
• open-telemetry/opentelemetry-collector-contrib
• [security] audit repository tooling opentelemetry-collector-releases#418
• [security] audit repository tooling opentelemetry-configuration#52
• [security] audit repository tooling opentelemetry-cpp#2282
• open-telemetry/opentelemetry-cpp-contrib
• [security] audit repository tooling opentelemetry-demo#1073
• [security] audit repository tooling opentelemetry-dotnet#4817
• open-telemetry/opentelemetry-dotnet-contrib
• open-telemetry/opentelemetry-dotnet-instrumentation
• [security] audit repository tooling opentelemetry-network#236
• open-telemetry/opentelemetry-ebpf-build-tools
• open-telemetry/opentelemetry-erlang
• open-telemetry/opentelemetry-erlang-api
• open-telemetry/opentelemetry-erlang-contrib
• [security] audit repository tooling opentelemetry-go#4459
• [security] audit repository tooling opentelemetry-go-build-tools#390
• [security] audit repository tooling opentelemetry-go-contrib#4413
• [security] audit repository tooling opentelemetry-go-instrumentation#407
• [security] audit repository tooling opentelemetry-go-vanityurls#19
• [security] audit repository tooling opentelemetry-helm-charts#930
• [security] audit repository tooling opentelemetry-java#5745
• open-telemetry/opentelemetry-java-contrib
• open-telemetry/opentelemetry-java-examples
• open-telemetry/opentelemetry-java-instrumentation
• [security] audit repository tooling opentelemetry-js#4101
• open-telemetry/opentelemetry-js-api
• [security] audit repository tooling opentelemetry-js-contrib#1751
• [security] audit repository tooling opentelemetry-lambda#862
• open-telemetry/opentelemetry-log-collection
• open-telemetry/opentelemetry-operator
• [security] audit repository tooling opentelemetry-php#1131
• open-telemetry/opentelemetry-php-contrib
• open-telemetry/opentelemetry-php-instrumentation
• open-telemetry/opentelemetry-profiling
• open-telemetry/opentelemetry-proto
• [security] audit repository tooling opentelemetry-proto-go#139
• open-telemetry/opentelemetry-proto-java
• open-telemetry/opentelemetry-proto-profile
• [security] audit repository tooling  opentelemetry-python#3467
• [security] audit repository tooling opentelemetry-python-contrib#1991
• [security] audit repository tooling opentelemetry-ruby#1519
• open-telemetry/opentelemetry-ruby-contrib
• open-telemetry/opentelemetry-rust
• open-telemetry/opentelemetry-sandbox-web-js
• open-telemetry/opentelemetry-specification
• open-telemetry/opentelemetry-sqlcommenter
• open-telemetry/opentelemetry-swift
• [security] audit repository tooling opentelemetry.io#3212
• open-telemetry/otel-arrow
• open-telemetry/otel-arrow-collector
• open-telemetry/oteps
• open-telemetry/semantic-conventions
• open-telemetry/semantic-conventions-java
• open-telemetry/sig-security
• open-telemetry/stackoverflow2slack
• [security] audit repository tooling  prometheus-interoperability-spec#74

[codeboten]

Start this by documenting what's enabled in the collector repository and producing a form from it

[codeboten]

The following tools are configured for the OpenTelemetry Collector repository:

• CodeQL enabled via GitHub Actions
• Static code analysis: govulncheck [https://pkg.go.dev/golang.org/x/vuln] enabled on every build
• Repository security settings
  • Security Policy ✅
  • Security advisories ✅
  • Private vulnerability reporting ✅
  • Dependabot alerts ✅
  • Code scanning alerts ✅

[codeboten]

Confirmed the same is configured for the OpenTelemetry Collector Contrib repository

[JonZeolla]

We should consider Allstar for monitoring organization-wide policies. The quickstart may meet our needs

[svrnm]

+1 for Allstar

[oly-baby]

GOOD DAY,

I AM AN OUTREACH APPLICANT, CAN I WORK ON THIS

[jpkrohling]

@oly-baby, welcome! Sure, feel free to pick one of the repositories from the list (see the issue description), create an issue on the repository to track the work, and write a report similar to @codeboten's one (a few comments up, here: #12 (comment)).

[Davidlred]

Hello guys, i'm an Outreachy applicant, and i'd like to work on one of the issue.

how do i take off ?

[jpkrohling]

@Davidlred, see my previous comment. I'd recommend leaving a comment on the issue you pick, stating that you are working on it. If you need ideas for other tasks, join the #otel-sig-security channel on the CNCF Slack.

[sakshi-1505]

Hello @jpkrohling , I am picking up one of the issue from the above list.

[sakshi-1505]

We can use the following tracking issue for opentelemetry-python: open-telemetry/opentelemetry-python#3467

[sakshi-1505]

We can use the following tracking issue for build-tools: open-telemetry/build-tools#212

[sakshi-1505]

We can use the following tracking issue for opentelemetry-python-contrib: open-telemetry/opentelemetry-python-contrib#1991

[arademm]

Hello, I'm an Outreachy applicant. I would love to contribute to this project.

[jpkrohling]

@arademm, see my previous comment. I'd recommend leaving a comment on the issue you pick, stating that you are working on it. If you need ideas for other tasks, join the #otel-sig-security channel on the CNCF Slack.

[pichlermarc]

The open-telemetry/opentelemetry-js-api entry can be checked on the list - it's an archived repository, the package that was hosted there was integrated in to https://github.com/open-telemetry/opentelemetry-js 🙂