ossf / ossf/security-baseline

Audit and split requirements combining multiple obligations

Open
#546 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
166
Forks
44
Avg merge
1d 7h
Merged PRs (30d)
13

Description

As per the style guide:

A Single Requirement corresponds to a single Test
Every requirement MUST describe exactly one testable behavior. Each requirement should map directly to a single implementation test. If a requirement has multiple obligations that can pass/fail independently, split them into separate requirements. An easy way to enforce this is to avoid using "and" in the requirement text.

Several requirements currently join two or more independently-testable obligations with "and" (e.g., "evaluated ... and blocked", "document when and how"). A project could satisfy one clause while failing the other, so these need to be reviewed and, where applicable, split so each requirement maps to a single test.

Precedent: #443 split BR-01 into three requirements.

Requirements to review

CC: @eddie-knight @funnelfiasco

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with docs/style-guide.md, then locate the source definitions for OSPS-VM-06.02, OSPS-VM-05.03, OSPS-VM-05.01, OSPS-VM-01.01, and OSPS-QA-06.02. Compare each requirement with the single-test rule and precedent in #443. Done means every independently testable obligation is represented by its own requirement.

Written by the indexing model from the issue text.

Assessment

Domain
documentation
Issue type
Documentation
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.