Obtain OpenSSF Best Practices Badge

[amagyar-iohk]

Background

• Goal is to improve community trust
• Links
  • https://www.bestpractices.dev/en
  • https://scorecard.dev/
  • https://github.com/LF-Decentralized-Trust/governance/blob/main/tac/project-updates/2025/2025-annual-Identus.md

DoD (Definition of Done)

• achieve a Passing Level as defined at https://www.bestpractices.dev/en/criteria_stats
• this will be achieved across all 7 repos as shown at the OpenSSF Badge Tracker URL private

Implementation hints/details

• Allain guesstimates ~40 person-days of work to complete all of this
• ...

[amagyar-iohk]

Add scorecard to:

• Cloud-agent: hyperledger-identus/cloud-agent@fddab0e
• Mediator: hyperledger-identus/mediator@1bb62ba
• SDK-TS: hyperledger-identus/sdk-ts@667a0cb
• SDK-Swift: hyperledger-identus/sdk-swift@8fa112b
• Neoprism: hyperledger-identus/neoprism@446b5b9
• Integration: c39875d

Add scorecard badges:

• Cloud-agent
• Mediator
• SDK-TS
• SDK-Swift
• Neoprism
• Integration

Apply StepSecurity hardener:

• Cloud-agent
• Mediator
• SDK-TS
• SDK-Swift
• Neoprism
• Integration

[amagyar-iohk]

Evaluate issues presented.

@mineme0110 do we have a score goal for all repos?

[pparker]

Update

• @amagyar-iohk making good progress (see https://www.bestpractices.dev/en/projects?q=identus)
• He's talking to Service Desk to move SonarCloud binding to different orgs
• Needs help with the Security section (@mineme0110 is helping)