Setup Commit Signing for NIST OSCAL Developers

[aj-stein-nist]

User Story:

As an OSCAL tool developer, in order to ensure the integrity of the OSCAL project source code, I would like to see a policy, procedure, and implementation of how the NIST OSCAL development team signs commits merged into the official source code repositories.

Goals:

Per community request from those reviewing SP 800-53A updates and other related cybersecurity standards from NIST , we would like to look into developer security and supply chain security goals (see 800-53 Revision 5, 800-53A Revision 5, 800-161v1, and SSDF). We can start with designing a mechanism to assist NIST OSCAL developers to setup commit signing for their git commits and enforce commit signing during the development lifecycle.

Dependencies:

• [ ] Policy guidance
• [ ] Review of possible architectures and implementations
• [ ] First attempts at threat modeling to determine key risks and future approaches

Acceptance Criteria

• [ ] All OSCAL website and readme documentation affected by the changes in this issue have been updated. Changes to the OSCAL website can be made in the docs/content directory of your branch.
• [ ] A Pull Request (PR) is submitted that fully addresses the goals of this User Story. This issue is referenced in the PR.
• [ ] The CI-CD build process runs without any reported errors on the PR. This can be confirmed by reviewing that all checks have passed in the PR.

{The items above are general acceptance criteria for all User Stories. Please describe anything else that must be completed for this issue to be considered resolved.}

[aj-stein-nist]

OK, @trevor-vaughan, Dave liked your comments today so we will add this to the backlog. Feel free to subscribe and provide feedback as there are updates.

[aj-stein-nist]

GitHub announced a service improvement that might make this more practical than before with SSH key signing.

[aj-stein-nist]

Probably worth considering after one or more team members presents on commit signing for team education and awareness.