This project is supported under the Linux Foundation CRA stewardship framework, as described at https://www.linuxfoundation.org/security. Security vulnerabilities should be reported through the mechanisms described below, which we will coordinate with our CRA steward. For actively exploited vulnerabilities and severe incidents that may require CRA escalation, please use the project’s emergency security reporting mechanisms as appropriate.

Docker images published by this project are signed using Cosign keyless signing via Sigstore. Signatures are recorded in the public Rekor transparency log — no private key is stored or required.

To verify an image, install Cosign (instructions) and run:

cosign verify \
  --certificate-identity "https://github.com/com-pas/compas-cim-mapping/.github/workflows/release-please.yml@refs/heads/main" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  lfenergy/compas-cim-mapping:<tag>

Replace <tag> with the specific release tag (e.g. 0.12.1) or latest.

Please go to Security Advisories to privately report a security vulnerability, our contributors will try to respond within a week of your report with a rough plan for a fix and new tests.