Release Security Checks¶
Key Insight
Release security ensures artifacts are signed and properly distributed.
Checks that measure release security practices including signatures, provenance, distribution, and licensing.
Covered Checks¶
Signed-Releases¶
Target: 10/10 with SLSA provenance
What it checks: Whether releases have cryptographic signatures and SLSA provenance
Why it matters: Proves artifacts weren't tampered with between build and distribution
Effort: 2-4 hours
Priority: High (required for SLSA compliance)
Advanced: Signed-Releases Advanced Guide
Packaging¶
Target: 10/10 by publishing to package registries
What it checks: Whether project is published to recognized package registries
Why it matters: Demonstrates wider distribution and established ecosystem integration
Effort: 1-2 hours
Priority: Medium (improves discoverability)
License¶
Target: 10/10 with OSI-approved license
What it checks: Whether repository contains OSI-approved open source license
Why it matters: Legal clarity for contributors and users
Effort: 5 minutes
Priority: High (quick win)
Check Summary¶
| Check | Target | Effort | Priority | Weight |
|---|---|---|---|---|
| License | 10/10 | 5 min | High | Low |
| Packaging | 10/10 | 1-2 hrs | Medium | Low |
| Signed-Releases | 10/10 | 2-4 hrs | High | High |
Remediation Priority Order¶
Order of implementation for fastest improvement:
- License (5 minutes) - Add LICENSE file
- Packaging (1-2 hours) - Publish to package registry
- Signed-Releases (2-4 hours) - Implement SLSA provenance
Total estimated effort: 3-6 hours for all three checks.
Check Interactions¶
Signed-Releases + Binary-Artifacts:
SLSA provenance proves binaries were built from source in trusted environment.
Packaging + Signed-Releases:
Package registries often require signatures for publishing, making these complementary.
License + CII-Best-Practices:
OSI-approved license is required for OpenSSF Best Practices Badge.
Related Content¶
Other check categories:
- Supply Chain Checks - Pinned-Dependencies, Dangerous-Workflow, Binary-Artifacts, SAST
- Security Practices Checks - Security-Policy, Vulnerabilities, Fuzzing
- Code Review Checks - Code-Review, Contributors, Maintained
Guides:
- Scorecard Index - Overview of all 18 checks
- Tier 2 Progression - Medium complexity improvements
- SLSA Provenance - Complete SLSA guide
Next Steps¶
-
Quick win: Add LICENSE file (5 minutes)
-
Publish package: Set up package registry publishing (1-2 hours)
-
SLSA provenance: Implement slsa-github-generator (2-4 hours)
Remember: License is immediate. Packaging demonstrates maturity. Signed-Releases is required for SLSA compliance.
Release security demonstrates supply chain integrity. Start with License, add Packaging for visibility, then implement Signed-Releases for provenance.