The software check-up.
Five pieces work together to check whether an open source project is safe. Here they are as a trip to the doctor.
Meet the cast
Each card links to the real thing.
The checklist
OSPS BaselineA list of things every healthy project should do. "Lock the front door. Tell people how to report a problem."
The nurse
pvtr-github-repo-scannerKnows the checklist by heart. Looks at a GitHub project and marks every item on the list.
The clinic
privateer (the pvtr command)The building where nurses work. You walk in, and it calls the right nurse for you.
The training kit
privateer-sdkEverything you need to train a new nurse. The clinic is built from it too.
The scoreboard
grc.storeA public wall where results get pinned. Anyone can walk by and see who's healthy.
What a check-up looks like
Run it once by hand, or let a GitHub Action run it on a schedule.
- Open the clinicrun
pvtr run - The nurse checksevery item on 📋
- A report card PassedFailedNeedsReview
- Pin it upon grc.store
How they lean on each other
The kit builds the clinic and the nurse. The nurse reads the checklist. The grades go to the scoreboard.
- Kitbuilds
- Clinicand
- Nursewho reads
- Checklistand sends grades to
- Scoreboard
The funny part
The clinic gets a check-up too.
Every week the nurse checks pvtr and privateer-sdk, the very clinic it works in. Their report cards hang on the
scoreboard like everyone else's.