Skip to content

chore: fill or remove RSR template placeholders - #17

Merged
hyperpolymath merged 4 commits into
mainfrom
fix/rsr-placeholders
Jul 28, 2026
Merged

chore: fill or remove RSR template placeholders#17
hyperpolymath merged 4 commits into
mainfrom
fix/rsr-placeholders

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

openssf-compliance.yml fails when any of the thirteen files it checks still contains a {{PLACEHOLDER}} token. This clears them, with no invention.

  • Deleted the TEMPLATE INSTRUCTIONS (delete this block before publishing) comment — the template says to delete it, and it is where every legend line lived, so a large share of the reported tokens were the file documenting its own placeholders.
  • Filled what the repository itself supplies: owner and repo from the git remote, project name, year, forge, main branch, contact email.
  • Removed PGP and website lines. https://github.com/<user>.gpg returns HTTP 200 for every account; with no key uploaded the body is a stub reading "This user hasn't uploaded any GPG keys". No key is published for either account, and commit signing here is SSH — unrelated. The template sanctions this: "Optional: Remove sections that don't apply (e.g. PGP if you don't use it)."\n\nA security policy telling a researcher to encrypt to a key that does not exist is worse than one that does not mention encryption.\n\nWhere applicable, this also fixes a misrouted advisory URL. A previous just init copied already-filled templates out of squisher-corpus, so 51 repositories directed vulnerability reports to hyperpolymath/squisher-corpus — a repository unrelated to the code being reported, meaning the affected maintainer never saw them. Repointed from this repository's own git remote.

hyperpolymath and others added 4 commits July 26, 2026 14:35
openssf-compliance.yml fails when any of the thirteen files it checks
still contains a {{PLACEHOLDER}} token. This clears them.

Three kinds of change, no invention:

The "TEMPLATE INSTRUCTIONS (delete this block before publishing)" comment
is deleted. The template says to delete it, and it is where every legend
line lives -- so a large share of the reported tokens were the file
documenting its own placeholders, not real unfilled fields.

Tokens derivable from the repository are filled: owner and repo from the
git remote, project name, year, forge, main branch, contact email.

PGP and website lines are removed rather than filled, because nothing
true could go in them. https://github.com/<user>.gpg returns HTTP 200 for
every account; with no key uploaded the body is a stub reading "This user
hasnt uploaded any GPG keys". No key is published for either account
here, and commit signing in this estate is SSH, which is unrelated. Only
one repository in the estate has a domain, so {{WEBSITE}} likewise has no
correct value. The template sanctions this: "Optional: Remove sections
that dont apply (e.g. PGP if you dont use it)." A security policy telling
a researcher to encrypt to a key that does not exist is worse than one
that does not mention encryption.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
A previous `just init` copied already-filled templates out of
squisher-corpus, so the identity landed in the BODY of the security
policy, not only in the legend block. burble/SECURITY.md directed
vulnerability reports to hyperpolymath/squisher-corpus, and 50 other
repositories did the same.

This is not cosmetic. A researcher who follows the policy files their
report against a repository that has nothing to do with the code they
were looking at, and the maintainer of the project actually affected
never sees it.

Repointed at this repository, derived from its own git remote. Also
rewords the prose that says "replace {{PLACEHOLDER}} tokens"; that is
documentation of the mechanism rather than an unfilled field, but the
OpenSSF gate greps for the token and cannot tell the difference -- the
same trap the Slavia Mustfile already records for its own probe.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
@hyperpolymath
hyperpolymath merged commit 84db159 into main Jul 28, 2026
11 checks passed
@hyperpolymath
hyperpolymath deleted the fix/rsr-placeholders branch July 28, 2026 16:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant