Repository navigation
Two-factor authentication is required for write access - #76
Merged
Merged
Conversation
The organisation now enforces two-factor authentication for every account with write access to this repository. Enforced rather than asked for: an account without it loses access instead of being reminded. Stated in GOVERNANCE.md rather than left as a setting nobody can see, because a project whose maintainers can be phished has no supply chain integrity whatever the rest of that document says. This is the OpenSSF Best Practices criterion require_2FA, which is a MUST at the gold level. MAINTAINERS.md also drops the note recording that one of the two invitations was pending acceptance. It has been accepted, so the note has done its job and the file now says what is true without a footnote about when it became true. Signed-off-by: Ayla Croft <aylacroft@proton.me>
HackTuah
force-pushed
the
docs/2fa-and-maintainers
branch
from
September 23, 2026 20:18
da05fef to
e59e95f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The organisation now enforces two-factor authentication for every account with write access to this repository. Enforced, not requested: an account without it loses access rather than receiving a reminder.
GOVERNANCE.mdsays so under Continuity, because a setting nobody can see is not a control anyone can check. The reasoning is stated with it: a project whose maintainers can be phished has no supply chain integrity whatever the rest of that document claims.What this is worth on the badge
This is the OpenSSF Best Practices criterion
require_2FA, which is a MUST at the gold level — not silver. Turning it on now means one fewer gold criterion to chase later, and it costs nothing today.The companion criterion
secure_2FAis a SHOULD at gold and asks that the second factor be cryptographic. GitHub can require 2FA but cannot require a method, so that one depends on what the maintainers actually use: a passkey, security key or TOTP app meets it; SMS does not.MAINTAINERS.mdalso drops the note recording that one of the two invitations was pending acceptance. It has been accepted, so the note has done its job.Evidence
mix gateexit 0; 575 passed, 18 excluded; coverage 80.31%.