ottlinger commented on code in PR #677: URL: https://github.com/apache/creadur-rat/pull/677#discussion_r3420711311
########## THREAT_MODEL.md: ########## @@ -0,0 +1,247 @@ +<!-- + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +--> +# Apache Creadur (RAT) — Threat Model + +## §1 Header + +- **Project:** Apache Creadur — primarily **RAT (Release Audit Tool)** + (`apache/creadur-rat`), with sibling tools **Whisker** + (`apache/creadur-whisker`, license-documentation generator) and **Tentacles** + (`apache/creadur-tentacles`, release-bundle analyzer). This model is written + in `creadur-rat` and covers the Creadur dev-tool family; Whisker/Tentacles + share RAT's trust profile (§2). +- **Written against:** `main`/`master` @ HEAD (2026-06). +- **Author:** ASF Security team, via the threat-model-producer rubric (Scovetta + rubric) at the Creadur PMC's request (path 3). +- **Status:** DRAFT — under maintainer review (2026-06-10). Not yet ratified. +- **Reporting cross-reference:** §8-violating findings via the ASF security + process ([`SECURITY.md`](SECURITY.md)); §3/§9 findings closed citing this doc. +- **Provenance legend:** *(documented)* / *(maintainer)* / *(inferred)* — each + *(inferred)* has a §14 open question. +- **Draft confidence:** ~14 documented / 0 maintainer / 16 inferred. + +**What it is.** RAT is a **build-time / CLI license-auditing tool**: it walks a +source tree, matches files against configurable license/header definitions, and +reports unapproved or unknown licenses. It runs as a **CLI**, an **Ant task**, +or a **Maven plugin** — always **in the developer's or CI's own process**, +never as a network service. Whisker generates license documentation; Tentacles +inspects staged release bundles. None is a server. + Review Comment: Would it make sense to add a new notion here as RAT can be used to change your own sources to include license headers? In this way user input can be altered or is this not relevant from a security-scope? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
