Orange-OpenSource / Orange-OpenSource/github-security-alerts
For `project`, improve security of releases (suggestion)
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 5
- Forks
- 1
- Avg merge
- 9h 26m
- Merged PRs (30d)
- 13
Description
Context
Today in 2026 we, open source maintainers and users, face a lot of supply chain attacks.
These attacks are based sometimes on maintainers accounts compromises were attackers push rogue version of releases.
It could be nice, like we do in OUDS iOS, to:
- use the GitHub immutable release feature to block the tag in use for a given release
- use signed tags to proove the tags are legit (with in documentation a way to check the origin of the tag like we did on OUDS iOS)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No repository files, tests, or release workflow entry points are identified. Start by examining the repository's GitHub release configuration and compare it with the linked OUDS iOS release and documentation examples. Done should include an agreed implementation for immutable releases and signed tags, plus instructions for verifying tag origin.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- git, github
- Domain
- release, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100