[wemeetagain]

Enroll projects/lodestar

Enroll https://github.com/ChainSafe/lodestar#unstable, with reports sent to lodestar@chainsafe.io and CC'd to cayman@chainsafe.io.

Lodestar is a production Ethereum consensus client maintained by ChainSafe. It processes untrusted P2P traffic and consensus objects and runs validator signing duties, making consensus correctness, availability, and validator security critical.

The Dockerfile lives alongside project.yaml, keeps source and development dependencies in /src, and prepares pinned test fixtures while networking is available. Includes scanner guidance covering consensus, networking, validator safety, and offline reproductions.

• I am a core maintainer of this project.
• I accept the OSS Scanner terms.
• I confirm that I believe my project meets the inclusion criteria and is an established project that users depend on.
• project.yaml follows the README (one project per PR; tools/validate.py passes locally).
• tools/check lodestar builds the project, and its tests run in the shell that follows.
• primary_contact must be the email address of the primary security contact.
• There is a Dockerfile that builds the project (required) in one of two places: in the project's repository at the path dockerfile: names, or next to project.yaml in this repo.
• threat_model.md is written for this project (recommended but optional), placed in the same way: in the repository at the path threat_model: names, or next to project.yaml in this repo.

Validation:

• python3 tools/validate.py passed.
• python3 tools/check --no-shell lodestar completed for Lodestar commit 9203d3d7da2b64a2114a940a5fb3390d4d151a99.
• In the finished image with --network none --cpus 2 --memory 8g, 28 targeted SSZ/Snappy decoding and validator slashing-protection tests passed, plus 8 minimal-preset voluntary-exit fork-transition spec tests.
• Prettier checked the new Markdown and YAML files.

The terms checkbox is left open for maintainer review; this draft does not record terms acceptance or a CLA signature.

This PR was written primarily by OpenAI Codex.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[github-actions]

Enrolment triage: projects/lodestar

Repository: ChainSafe/lodestar at unstable · opened by wemeetagain

	Check	Result
✅	Repository	created 8 years ago, last push today
ℹ️	Stars / forks	1,428 stars · 497 forks · 33 watching
ℹ️	Outside participants	15 people from outside the project opened 19 of the last 100 issues and pull requests
ℹ️	Criticality score	0.75 on the OpenSSF scale of 0 to 1 signals created_since 101, updated_since 0, contributor_count 163, org_count 6, commit_frequency 20.3, recent_releases_count 48, closed_issues_count 689, updated_issues_count 759, comment_frequency 3.2, dependents_count 2,169
ℹ️	Package rank	by downloads: nothing from this repository found in the top 10,000 on npm
✅	License	Apache-2.0
✅	Opened by an active maintainer	member of the owning organisation; 56 commits in the last 12 months; #1 contributor
⚠️	Contact in SECURITY.md	lodestar@chainsafe.io is not in SECURITY.md, which gives security@chainsafe.io
ℹ️	OSS-Fuzz	not found in OSS-Fuzz
ℹ️	.oss-scanner/ in the repository	not present; the Dockerfile is in this pull request
✅	Pull request scope	only this project's directory
✅	tools/validate.py	passes
✅	Checklist	all 8 ticked

_{Automated, from public data, to help reviewers. Enrolment is decided case by case against the criteria. If you think we got something wrong, please tell us in a reply.}

[wemeetagain]

I have read the CLA Document and I hereby sign the CLA

[wemeetagain]

@srxzr-ant I noticed you got the Ethereum consensus specs added to the program (#1078), very happy to see that.

These are the specs we rely on, and ethereum client software has a much larger security surface.
I know it would do a lot of good for our ecosystem to get us (and other ethereum clients) included. :)