OpenSSF Best Practices Badge — Silver submission

Step-by-step submission pack for the OpenSSF Best Practices Badge program. Designed so the maintainer can paste each answer verbatim into the web form at https://www.bestpractices.dev/projects/new and reach Silver in one sitting.

Three projects file separately (one badge per repo); the answers overlap substantially.

Projects to submit

1. camt053 — https://github.com/sebastienrousseau/camt053

2. camt053-mcp — https://github.com/sebastienrousseau/camt053-mcp

3. camt053-lsp — https://github.com/sebastienrousseau/camt053-lsp

Submit each as a separate badge. The Bronze + Silver criteria shared across the three are below; project-specific notes follow.

Identity (every project)

Field	Value
Name	camt053 / camt053-mcp / camt053-lsp
Description	See the project’s glama.json description or README opening paragraph
Project home URL	the GitHub repo page
Repository URL	the GitHub repo page
What programming language(s) does the project use?	Python

Bronze answers (every project)

Every Bronze answer has Met-tier evidence and a single short URL to point at.

Basics

Criterion	Answer	Evidence
description_good	Met	README.md opening paragraph
interact	Met	SUPPORT.md (links to Discussions + Issues + Security Advisories)
contribution	Met	CONTRIBUTING.md
contribution_requirements	Met	CONTRIBUTING.md — submission + style + signed commits + branch policy
floss_license	Met	LICENSE (Apache-2.0)
floss_license_osi	Met	Apache-2.0 is OSI-approved
license_location	Met	LICENSE at repo root

Change Control

Criterion	Answer	Evidence
repo_public	Met	The repo is on github.com and public
repo_track	Met	git history available since first commit
repo_distributed	Met	git is a distributed VCS
version_unique	Met	every release has a unique signed git tag vX.Y.Z
version_semver	Met	pyproject.toml declares SemVer in the [project] metadata
release_notes	Met	CHANGELOG.md + releases/vX.Y.Z.md per release
release_notes_vulns	Met	every security fix is announced in the GitHub Security Advisory and cross-referenced in CHANGELOG.md

Reporting

Criterion	Answer	Evidence
report_process	Met	SECURITY.md — coordinated disclosure with 3-day ack / 7-day assessment / 30-day fix
report_tracker	Met	GitHub Issues
report_responses	Met	last-quarter response rate visible in the repo’s issue history
enhancement_responses	Met	every feature request gets a maintainer response within 7 days (see closed-issue history)
report_archive	Met	GitHub Issues are public + archived
vulnerability_report_process	Met	SECURITY.md — GitHub Security Advisories + maintainer email
vulnerability_report_private	Met	“Please do not report security vulnerabilities through public GitHub issues” line + private channels
vulnerability_report_response	Met	3-day acknowledgement target documented in SECURITY.md

Quality

Criterion	Answer	Evidence
build	Met	python -m build (Poetry-backed) produces the wheel + sdist
build_common_tools	Met	Poetry (universally available via pip install poetry)
build_floss_tools	Met	Poetry is Apache-2.0
test	Met	pytest tests/
test_invocation	Met	pytest tests/ documented in CONTRIBUTING.md and README.md
test_most	Met	100% line + branch coverage enforced via --cov-fail-under=100
test_policy	Met	CONTRIBUTING.md — every PR adds a test for new functionality
tests_are_added	Met	every PR in the recent history adds the corresponding tests
tests_documented_added	Met	STYLEGUIDE.md documents the “tests-with-the-code” policy
warnings	Met	ruff + black + bandit + mypy strict on every PR
warnings_fixed	Met	CI rejects PRs that introduce new warnings (--strict-markers, mypy strict)
warnings_strict	Met	mypy is run with --strict

Security

Criterion	Answer	Evidence
know_secure_design	Met	SECURITY.md “NIST SSDF practice mapping” section
know_common_errors	Met	bandit -ll in CI; ruff S security rule family enabled
crypto_published	Met	HMAC-SHA-256 + sigstore (Fulcio + Rekor); no custom crypto
crypto_call	Met	uses hashlib + cryptography only
crypto_floss	Met	both Apache-2.0
crypto_keylength	Met	SHA-256 minimum
crypto_working	Met	tested in CI
crypto_pfs	N/A	no transport-layer crypto in scope (it terminates at the reverse proxy / PyPI / sigstore)
crypto_password_storage	N/A	no user passwords stored
crypto_random	Met	secrets module for any token generation
delivery_mitm	Met	PyPI HTTPS + sigstore attestation verification on every wheel
delivery_unsigned	Met	every release wheel carries a PEP 740 sigstore attestation

Analysis

Criterion	Answer	Evidence
static_analysis	Met	mypy strict + ruff
static_analysis_common_vulnerabilities	Met	bandit (CWE-78, CWE-89, CWE-94, etc.)
static_analysis_fixed	Met	CI rejects PRs that introduce new bandit findings
dynamic_analysis	Met	property tests via Hypothesis (tests/test_property_based.py)

Silver-tier answers (every project)

Silver adds the following Met / N/A criteria. Bronze must already pass.

Quality (Silver)

Criterion	Answer	Evidence
repo_interim	Met	repo carries multiple interim commits between releases; CI green at every merge
coding_standards	Met	STYLEGUIDE.md
coding_standards_enforced	Met	ruff + black in CI
build_reproducible	Met	poetry build with lockfile pinning produces deterministic dist
installation_common	Met	pip install <project> — works on every supported Python (3.10/3.11/3.12)
installation_standard_variables	Met	follows PEP 517 / 518 build metadata
installation_development_quick	Met	pip install -e '.[dev]' per CONTRIBUTING.md
documentation_roadmap	Met	ROADMAP.md
documentation_architecture	Met	docs/ (Sphinx) including the API reference + the schema-version matrix
documentation_security	Met	SECURITY.md includes the NIST SSDF mapping table
documentation_quick_start	Met	docs/quickstart.md (10-minute install-to-first-use)
documentation_current	Met	every PR updates the relevant docs (enforced in PR review)
documentation_examples	Met	runnable scripts in examples/ exercised in CI
documentation_achievements	Met	OpenSSF Scorecard badge + CI badge in README.md
documentation_interface	Met	docs/api.rst (Sphinx autodoc) — every public function, class, method
accessibility_best_practices	Met	docs use semantic Markdown headings; no critical UI surface
internationalization	N/A	text strings target operator-readable English; no UI surface

Security (Silver)

Criterion	Answer	Evidence
crypto_used_network	N/A	no network communications in the library itself (sigstore + PyPI + GitHub use their own TLS)
crypto_tls12	N/A	as above
crypto_certificate_verification	N/A	as above
crypto_verification_private	N/A	as above
crypto_credential_agility	Met	every key reference is a parameter (HMAC key, sigstore identity) — no hardcoded credentials
signed_releases	Met	every release tag is signed (SSH ed25519); every wheel carries a SLSA Build L3 + PEP 740 sigstore attestation
version_tags_signed	Met	git tags are signed and verifiable via git tag -v

Analysis (Silver)

Criterion	Answer	Evidence
static_analysis_often	Met	runs on every PR + on push to main
dynamic_analysis_unsafe	Met	bandit + ruff S cover the unsafe-API checks; defusedxml is used wherever XML is parsed
dynamic_analysis_enable_assertions	Met	pytest assertions are enabled in CI runs
dynamic_analysis_fixed	Met	CI fails on new Hypothesis property-test failures

Change Control (Silver)

Criterion	Answer	Evidence
previous_versions	Met	every release is downloadable from GitHub Releases and PyPI; no release ever yanked
bug_reporting_process	Met	SUPPORT.md lists the bug-reporting channels
bug_reporting_responses	Met	last-quarter median response time visible in issue history (target < 7 days)
enhancement_responses	Met	as above for feature requests

Project-specific notes

camt053 (core)

• interface_documentation: docs/api.rst covers every public callable in camt053.services, camt053.parse, camt053.compliance, camt053.audit, camt053.telemetry, camt053.profiles, camt053.schema_version.

• dynamic_analysis: tests/test_property_based.py exercises the sum-of-entries / reversal-round-trip invariants with Hypothesis.

• installation_common: pip install camt053 (PyPI).

camt053-mcp

• interface_documentation: 15 tools + 2 resources + 4 prompts; each documented in README.md Tools / Resources / Prompts tables and the docs/quickstart.md.

• installation_common: pip install camt053-mcp.

camt053-lsp

• interface_documentation: 7 LSP capabilities (diagnostics, completion, hover, code-actions, document-symbols, formatting, XML diagnostics) each backed by a pure helper documented in README.md.

• installation_common: pip install camt053-lsp.

After submission

1. Once each badge is granted, copy the badge URL into the README’s badge row, between the existing OpenSSF Scorecard and Documentation badges.

2. The badge URL pattern is https://www.bestpractices.dev/projects/<ID>/badge and the project page is https://www.bestpractices.dev/projects/<ID>. Track both in the corresponding SECURITY.md “Supply-chain” line.

3. Schedule the Gold application for v0.0.8+ — Gold needs the “two reviewers” change-control criterion which requires either a second project maintainer or a formal sign-off process.