{"id":27054919,"url":"https://github.com/aschmidt75/patterns-for-securing-software-delivery","last_synced_at":"2026-01-19T04:32:14.160Z","repository":{"id":276201850,"uuid":"897493318","full_name":"aschmidt75/patterns-for-securing-software-delivery","owner":"aschmidt75","description":"Catalog of Patterns For Improving the Security of Software Delivery Systems","archived":false,"fork":false,"pushed_at":"2025-07-07T14:42:23.000Z","size":27,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-07-07T15:47:17.444Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/aschmidt75.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2024-12-02T18:16:33.000Z","updated_at":"2025-07-07T14:42:27.000Z","dependencies_parsed_at":"2025-02-06T21:32:13.003Z","dependency_job_id":"be8609b9-c264-43af-8dda-2a07a678db7c","html_url":"https://github.com/aschmidt75/patterns-for-securing-software-delivery","commit_stats":null,"previous_names":["aschmidt75/patterns-for-securing-software-delivery"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/aschmidt75/patterns-for-securing-software-delivery","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aschmidt75%2Fpatterns-for-securing-software-delivery","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aschmidt75%2Fpatterns-for-securing-software-delivery/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aschmidt75%2Fpatterns-for-securing-software-delivery/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aschmidt75%2Fpatterns-for-securing-software-delivery/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/aschmidt75","download_url":"https://codeload.github.com/aschmidt75/patterns-for-securing-software-delivery/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aschmidt75%2Fpatterns-for-securing-software-delivery/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28561840,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-19T03:31:16.861Z","status":"ssl_error","status_checked_at":"2026-01-19T03:31:15.069Z","response_time":67,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-04-05T09:17:53.586Z","updated_at":"2026-01-19T04:32:14.154Z","avatar_url":"https://github.com/aschmidt75.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Patterns for Securing of Software Delivery\n\nThis repository aims to be catalog of patterns for improving the security of software delivery systems. Topics are around the Software Development Lifecycle (SDLC), DevSecOps and IT Security. \n\nIt is based on *Common Weaknesses* of Mitre's Common Weakness Enumeration\u0026trade;, in particular [2024's CWE Top 25 Most Dangerous Software Weaknesses](https://cwe.mitre.org/top25/) as well as [CAPEC, the Common Attack Pattern Enumeration and Classification\u0026trade;](https://capec.mitre.org/index.html).\n\nIt also relates to [Supply-chain Levels for Software Artifacts, or SLSA](https://slsa.dev/), in particular to their specified [Supply Chain Threats](https://slsa.dev/spec/draft/threats-overview).\n\n# Patterns\n\n- [**01** - Separate Continuous Integration from Continuous Delivery Pipelines](./patterns/01%20CI%20CD%20Separation.md)\n- [**02** - Review and Enforce proper Access Control and Least Privilege](./patterns/02%20Enforce%20Proper%20Access%20Control%20and%20Least%20Privilege%20in%20CICD%20Pipelines.md)\n- [**03** - Consider Pull Model Deployments instead of Pushing Deployments](./patterns/03%20From%20Push%20to%20Pull%20model%20Deployment.md)\n- [**04** - Secure Storage and Usage of Credentials in Pipelines](./patterns/04%20Secure%20Secrets%20Management.md)\n- [**05** - Replace shell scripts by Pipeline extensions](./patterns/05%20Replace%20Shell%20Scripts%20by%20Extensions.md)\n- [**06** - Harden Pipeline Code and Environments](./patterns/06%20Hardening%20Pipeline%20Code.md)\n- [**07** - Manage Upstream Dependencies](./patterns/07%20Manage%20Upstream%20Dependencies.md)\n\n\n# Supplementary Material\n\n- [SDLC-related CAPEC entries](./supplementary/S01%20SDLC-related%20CAPEC.md)\n\n# Additional References\n\n- [bureado/awesome-software-supply-chain-security](https://github.com/bureado/awesome-software-supply-chain-security)\n\n# License\n\n(C)opyright 2024,2025 @aschmidt75\n\nLicensed under [Creative Commons BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/)\n\n\u003cimg src=\"https://mirrors.creativecommons.org/presskit/buttons/88x31/png/by-sa.png\" width=\"100px\"\u003e \n\nCWE is a trademark of The MITRE Corporation. CAPEC is a trademark of The MITRE Corporation. SLSA is copyright by The Linux Foundation.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faschmidt75%2Fpatterns-for-securing-software-delivery","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Faschmidt75%2Fpatterns-for-securing-software-delivery","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faschmidt75%2Fpatterns-for-securing-software-delivery/lists"}