Split BR-03 into development, release, and consumption requirements.

[evankanderson]

BR-03 requires:

Any websites, API responses or other services involved in the project development and release MUST be delivered using SSH, HTTPS or other encrypted channels

Which, on the face of it, would require that all developers ensure that any email sent relating to the project and project decisions is delivered via SMTPS. This is probably not intended.

I suspect this criteria will be more clear if we separate it into three concerns:

• Secure access to source code (and use of secure connections during code review) during development.

  This seems well-addressed by git forges such as GitHub, GitLab et al.

• Securing end-user access to released assets, including documentation. This would align with the best practices badge on sites_https and delivery_mitm.

  This seems addressed by a combination of checking the homepage is HTTPS and using a standard release mechanism (e.g. GitHub releases, language package managers, OCI repositories)

• Securing external content during the release pipeline (e.g. a SLSA attack D on an insecure download)

  This seems trickier to assess, though we could make a stab at checking Makefiles, shell scripts, and GitHub Actions for http:// URLs. This will obviously be leaky.

[funnelfiasco]

I think I'm good with this, other than the question I asked about -03.