david-thrower / cerebros-core-algorithm-alpha

The Cerebros package is an ultra-precise Neural Architecture Search (NAS) / AutoML that is intended to much more closely mimic biological neurons than conventional neural network architecture strategies.
Other
27 stars 4 forks source link

add-verified-gpg-signature-to-git-settings #91

Open david-thrower opened 1 year ago

david-thrower commented 1 year ago

Kind of issue: Process Change

After viewing a recent security tutorial and other sources, I am seeing that some frameworks require a local GPG signature for commits [1] before a commit can be merged in. We need to add to the CICD SOP or SOP-0001 a requirement that this setting be applied. The setting to create these signatures is easy to apply [2].

[1] https://garantir.io/three-frameworks-software-supply-chain-security/ [2] https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits