Opentelemetry-specification: Security requirements for GA

[andrewhsu]

High-level tracking issue for security requirements for OTel GA

• Security vuln scans in language SIG repos
  
  
  
  • related issue https://github.com/open-telemetry/oteps/issues/144
  
  
• Security policy
  
  
  
  • related PR https://github.com/open-telemetry/.github/pull/1
  
  
• Other items to track?

I suggest this issue be marked as required-for-ga and the eventual owner update the description if necessary

[alolita]

In order to support security vulnerability scans in the SIG repos for languages and Collector, the following security vulnerability scanning GitHub Actions workflows have been enabled so far.

1. CodeQL scan - Completed GHA workflows (merged) for the following SIG repos:
2. Collector: https://github.com/open-telemetry/opentelemetry-collector/pull/2325
3. Collector-contrib: https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/1922
4. Go: https://github.com/open-telemetry/opentelemetry-go/pull/1428
5. Go-contrib: https://github.com/open-telemetry/opentelemetry-go-contrib/pull/506
6. JavaScript: https://github.com/open-telemetry/opentelemetry-js/pull/1785
7. JavaScript-contrib: https://github.com/open-telemetry/opentelemetry-js-contrib/pull/298
8. Java: https://github.com/open-telemetry/opentelemetry-java/pull/2416
9. Java-instrumentation: https://github.com/open-telemetry/opentelemetry-java-instrumentation/pull/1971
10. Python: https://github.com/open-telemetry/opentelemetry-python/pull/1505
11. Python-contrib: https://github.com/open-telemetry/opentelemetry-python-contrib/pull/277

12. .Net-contrib: https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/55

13. GoSec scan: GHA workflows enabling GoSec scans to be run have been completed and merged for the following repos -

14. Go: https://github.com/open-telemetry/opentelemetry-go/pull/1429
15. Go-contrib: https://github.com/open-telemetry/opentelemetry-go-contrib/pull/507

Note: GHA workflows were submitted but closed for the Collector and collector-contrib since GoSec is already enabled for the Collector and Collector-contrib repos.

• Collector: https://github.com/open-telemetry/opentelemetry-collector/pull/2326 (closed)
• Collector-contrib: https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/1923

1. Security policy: @alolita will track work on security guidelines/policy in another issue.

[alolita]

Picking back up on this issue, we're adding further security vulnerabilities scanning using CodeQL and GoSec to the rest of the OpenTelemetry code repos. We also see the dotNet repo added a CodeQL scan using GitHub Actions in PR https://github.com/open-telemetry/opentelemetry-dotnet/pull/1324.

We are now adding CodeQL scans using GitHub Actions in the following repos:

• collector-builder
• cpp
• cpp-contrib
• dotnet-instrumentation
• java-contrib
• JS-API
• lambda
• log-collection
• operator

We will also be adding GoSec scans to be run using GitHub Actions workflows in the following repos:

• collector-builder
• lambda
• log-collection
• operator

cc: @xukaren @KKelvinLo

[arminru]

Thank you for taking care of this, @alolita, @xukaren and @KKelvinLo!