Ratify should complete a Tag Security Self Assessment (TSSA)

[akashsinghal]

What would you like to be added?

As part of Ratify sandbox donation, it was recommended by TAG security for Ratify to complete a tag security self assessment and submit for review https://github.com/cncf/tag-security/blob/main/community/assessments/README.md

Anything else you would like to add?

No response

Are you willing to submit PRs to contribute to this feature?

• Yes, I am willing to implement it.

[binbin-li]

Wonder if we should assess the security based on the incoming v2 version or v1. V1 has some design vulnerabilities that require breaking change to fix, probably v2 could make the TSSA look better.

[akashsinghal]

Wonder if we should assess the security based on the incoming v2 version or v1. V1 has some design vulnerabilities that require breaking change to fix, probably v2 could make the TSSA look better.

I agree. v2 makes more sense