diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 983fc491..d30dad0d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -62,8 +62,8 @@ jobs: + `\n` + `## Security\n` + `\n` - + `Binaries have been produced by the [Release workflow](https://github.com/${owner}/${repo}/actions/workflows/release.yml)` - + ` without human intervention.\n` + + `Binaries are compiled from source through the [Release workflow](https://github.com/${owner}/${repo}/actions/workflows/release.yml) without human intervention,` + + ` preventing any external interference.` + `\n` + 'You can verify that binaries have been produced by the workflow by using [GitHub Attestations](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds):\n' + `\n` diff --git a/SECURITY.md b/SECURITY.md index d16acad6..449e41e7 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,3 +1,3 @@ -# Security Policy +# Security -Vulnerabilities can be reported privately by using the [Security Advisory](https://github.com/bluenviron/mediamtx/security/advisories/new) feature of GitHub. +Check the [Security page](https://mediamtx.org/docs/other/security) on the website. diff --git a/docs/4-other/3-security.md b/docs/4-other/3-security.md new file mode 100644 index 00000000..861017db --- /dev/null +++ b/docs/4-other/3-security.md @@ -0,0 +1,21 @@ +# Security + +## Reporting vulnerabilities + +Vulnerabilities can be reported privately by using the [Security Advisory](https://github.com/bluenviron/mediamtx/security/advisories/new) feature of GitHub. + +## Binaries + +Binaries are compiled from source through the [Release workflow](https://github.com/bluenviron/mediamtx/actions/workflows/release.yml) without human intervention, preventing any external interference. + +You can verify that binaries have been produced by the workflow by using [GitHub Attestations](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds): + +```sh +ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx +``` + +You can verify the binaries checksum by downloading `checksums.sha256` and running: + +```sh +cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check +``` diff --git a/docs/4-other/3-specifications.md b/docs/4-other/4-specifications.md similarity index 100% rename from docs/4-other/3-specifications.md rename to docs/4-other/4-specifications.md diff --git a/docs/4-other/4-related-projects.md b/docs/4-other/5-related-projects.md similarity index 100% rename from docs/4-other/4-related-projects.md rename to docs/4-other/5-related-projects.md