SUPPLY CHAIN SECURITY IS FUBAR - A PROPOSAL FOR GITHUB

Summary from the TLDR InfoSec newsletter

The tj-actions and xz utils supply chain attacks have highlighted the issues that exist in establishing a maintainer's identity on GitHub. GitHub should require certain security features on a repository once it hits a certain popularity threshold, such as signed commits, PRs, blocking force pushes with an emergency override system, and 2FA for all admin credentials and maintainers. It should create an opt-in standard for verifying open-source maintainer identities, managing roster changes, and maintaining public audit logs and security settings. GitHub could also implement a production version of Chainguard's octo-sts for short-lived runner credentials and check for typosquatting in GitHub Actions.