[Security] Apply for OpenSSF Best Practices badge

[djach7]

Issue

OpenSSF Scorecard identified no effort to earn an OpenSSF Best Practices badge, scoring 0/10.

Risk Level

Low - The badge itself doesn't directly improve security, but achieving it ensures adherence to industry best practices.

Current State

• No OpenSSF Best Practices badge application
• Project may already meet many criteria but lacks formal recognition
• Missing community signal of security commitment

Recommendation

Apply for and earn the OpenSSF Best Practices badge (formerly CII Best Practices).

What is the Badge?

The OpenSSF Best Practices badge demonstrates that the project follows security and quality best practices:

• Passing level: Basic open-source best practices
• Silver level: More rigorous requirements
• Gold level: Exemplary practices

Badge Criteria Categories:

1. Basics - Documentation, licensing, version control
2. Change Control - Public version control, unique version numbers
3. Reporting - Bug reporting process, vulnerability disclosure
4. Quality - Testing, code review, static analysis
5. Security - Vulnerability response, secure development practices
6. Analysis - SAST tools, dynamic analysis

Why Apply?

• Visibility: Shows commitment to security and quality
• Improvement: Identifies gaps in current practices
• Trust: Helps users/contributors assess project maturity
• Alignment: Many criteria likely already met by tar-diff

Steps to Implement

1. Review badge criteria at https://bestpractices.coreinfrastructure.org/
2. Create a project application
3. Complete self-assessment questionnaire
4. Address any gaps identified during assessment
5. Submit for badge approval
6. Add badge to README.md once earned

Likely Status

Based on OpenSSF Scorecard results, tar-diff likely already meets many criteria:

• ✅ Has public version control (GitHub)
• ✅ Has a license (Apache 2.0)
• ✅ Has CI/CD with tests
• ✅ Uses SAST tools (CodeQL)
• ✅ Has vulnerability scanning (govulncheck)
• ✅ Has security policy (SECURITY.md)
• ✅ Has automated releases

Missing areas to address:

• ⚠️ Fuzzing (see [Security] Implement fuzzing for tar parsing and patching #87)
• ⚠️ Signed releases (see [Security] Sign releases and add SLSA provenance #88)
• ⚠️ May need to document some existing practices

Timeline

• Initial application: ~1-2 hours
• Addressing gaps: Varies (some already tracked in other issues)
• Badge approval: Typically fast once criteria met

References

• OpenSSF Best Practices Badge
• Badge Criteria
• OpenSSF Scorecard - CII Best Practices
• OpenSSF Scorecard Score: 0/10

Related

Part of OpenSSF Scorecard evaluation THEEDGE-4717 (overall score: 6.8/10)