What Gets Reviewed
The review covers the changes in your repository between the last approved commit (the baseline) and the commit you asked us to sign. It runs in steps:
- Risk. The change set is scored. Documentation-only changes can be approved automatically. Changes to build scripts, dependencies or binaries are escalated.
- Scanners. Your source at the requested commit is scanned on our side with gitleaks for secrets and osv-scanner for known vulnerable dependencies. Configuration in your repository, such as
.gitleaksignoreor inlinegitleaks:allow, is not used. - Human review. Anything not approved automatically is reviewed by a member of the OSSign team.
The first review of a project has no baseline, so it covers the whole tree and always reaches a person. Once approved, that commit becomes the baseline and later reviews only show what changed since.
A rejected request is not signed. The status of the request tells you why, and the reviewer can add a note to you.
Making Reviews Faster
- Tag releases from a clean history: small, focused commits are quicker to review than one large squash.
- Keep binaries and generated files out of the repository where you can, try to always build from sources.
The Review Report
Each signed release in your OSSign repository carries four files from the review:
| File | Content |
|---|---|
review-report.md |
Summary: decision, risk score, static checks, findings, commits, and the reviewer's note to you. Used as the release text. |
review-report.json |
The same in full, machine readable |
review-scans.zip |
The raw scanner output plus the JSON report |
review-report.json.p7s |
A detached signature over the JSON, made with the same key that signed your files |
Verifying a Report
Anyone can check that a report came from OSSign and was not changed, with the ossign CLI:
ossign verify --detached review-report.json.p7s review-report.json
To check a signed file itself:
ossign verify tool.exe
ossign verify exits with code 2 for files signed with a test certificate. The template's verify step refuses to publish such files.