example.baseline.toml

# Example OpenSSF Baseline User Configuration
# Copy this file to .baseline.toml in your repository root
#
# This file allows you to:
# - Override control settings (mark as N/A, use different adapter)
# - Define custom adapters (Kusari, custom scripts)
# - Configure control groups for batch settings
# - Add custom controls specific to your organization

version = "1.0"

# Framework to extend (this is typically "openssf-baseline")
extends = "openssf-baseline"

# Global settings
[settings]
# Cache check results for faster re-runs
cache_results = true
cache_ttl = 300  # 5 minutes

# Timeout for adapter operations (seconds)
timeout = 300

# Fail the audit if any check produces an error
fail_on_error = false

# Run independent checks in parallel
parallel_checks = true
max_parallel = 5

# =============================================================================
# Plugin Security Configuration
# =============================================================================
# Configure trusted publishers for plugin verification.
# By default, kusari-oss and kusaridev are trusted.

[plugins]
# Global settings for all plugins
# global_allow_unsigned = false              # Require signed plugins (production)
# global_trusted_publishers = [              # Additional orgs to trust globally
#     "https://github.com/my-company",
# ]

# Per-plugin configuration examples:

# Trust default publishers (kusari-oss, kusaridev) - no extra config needed
# [plugins."darnit-baseline"]
# version = ">=1.0.0"

# Allow a specific plugin to be unsigned (for local development)
# [plugins."my-dev-plugin"]
# version = ">=0.1.0"
# allow_unsigned = true

# Trust a third-party plugin publisher
# [plugins."third-party-compliance"]
# version = ">=2.0.0"
# trusted_publishers = ["https://github.com/trusted-vendor"]

# =============================================================================
# Custom Adapters
# =============================================================================

# Example: Kusari adapter for SCA and dependency scanning
[adapters.kusari]
type = "command"
command = "kusari"
output_format = "json"
timeout = 300

# Example: Custom script adapter for internal security checks
# [adapters.security-scanner]
# type = "script"
# command = "./scripts/security-check.sh"
# output_format = "json"
# timeout = 120

# Example: Python module adapter for custom checks
# [adapters.my-checker]
# type = "python"
# module = "my_company.security.checker"
# class = "SecurityChecker"

# =============================================================================
# Control Overrides
# =============================================================================

# Use Kusari for pre-release SCA checks
[controls."OSPS-VM-05.02"]
check = { adapter = "kusari" }
# Remediation still uses builtin (provides guidance)
remediation = { adapter = "builtin" }

# Use Kusari for dependency scanning
[controls."OSPS-VM-05.03"]
check = { adapter = "kusari" }

# Mark a control as Not Applicable with reason
# Example: Pre-1.0 project without releases
[controls."OSPS-BR-02.01"]
status = "n/a"
reason = "Pre-1.0 project, no releases yet"

# Example: Disable a control temporarily
# [controls."OSPS-QA-04.01"]
# status = "disabled"
# reason = "Temporarily disabled while migrating to monorepo"

# =============================================================================
# Control Groups
# =============================================================================
# Apply shared configuration to multiple controls at once

# Group all vulnerability management controls to use Kusari
[control_groups.vulnerability-management]
controls = ["OSPS-VM-05.02", "OSPS-VM-05.03"]
check = { adapter = "kusari" }

# Example: Mark multiple controls as N/A
# [control_groups.pre-release]
# controls = ["OSPS-BR-02.01", "OSPS-BR-02.02"]
# status = "n/a"
# reason = "No releases for this internal tool"

# =============================================================================
# Custom Controls
# =============================================================================
# Add organization-specific controls beyond the framework

# Example: Custom internal security review requirement
# [controls."CUSTOM-SEC-01"]
# name = "InternalSecurityReview"
# level = 1
# domain = "SA"
# description = "Require internal security review sign-off for releases"
# check = { adapter = "security-scanner" }