Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Feature: add scorecard to your project #1298

Closed
laurentsimon opened this issue Apr 1, 2022 · 3 comments
Closed

Feature: add scorecard to your project #1298

laurentsimon opened this issue Apr 1, 2022 · 3 comments
Milestone
v0.24.0

Comments

@laurentsimon
Copy link

laurentsimon commented Apr 1, 2022 •
edited
Loading

I ran the OpenSSF's scorecard on this project and found that branch protection and code reviews are not enforced.

I chatted with @josepalafox and he suggested I create this issue to start a discussion.

Given the popularity of this project and its sensitivity (access to build pipeline, etc), it would be beneficial to install scorecard as suggested in the workflow hardening guideline.

/cc @nebuk89
@laurentsimon
Copy link
Author

laurentsimon commented Apr 1, 2022 •
edited
Loading

/cc @isarkis @sethvargo

@mumoshu mumoshu added this to the v0.24.0 milestone Apr 24, 2022
@mumoshu
Copy link
Collaborator

mumoshu commented May 9, 2022 •
edited
Loading

@laurentsimon Thanks for bringing this up. I just ran docker run -e GITHUB_AUTH_TOKEN=$OPENSSF_SCORECARD_GITHUB_TOKEN gcr.io/openssf/scorecard:stable --show-details --repo=https://github.com/actions-runner-controller/actions-runner-controller to see what it finds. Currently, it reports Aggregate score: 5.8 / 10. My goal is to make it close enough to 10. You can expect me to submit a few PRs to address each finding!

mumoshu added a commit that referenced this issue May 9, 2022
@mumoshu
Enable CodeQL Alerts following the OpenSSF Security Scorecards recomm…
7bf5751 
…endation

Ref #1298
@mumoshu mumoshu mentioned this issue May 9, 2022
Merged
mumoshu added a commit that referenced this issue May 9, 2022
@mumoshu
Pin GitHub Actions workflow dependencies by hash
bd06435 
as recommended in https://github.com/ossf/scorecard/blob/5758364c82f7fc72b256f9a8cfc89dc550d7dd66/docs/checks.md#pinned-dependencies

Ref #1298
@mumoshu mumoshu mentioned this issue May 9, 2022
Merged
mumoshu added a commit that referenced this issue May 10, 2022
@mumoshu
Create SECURITY.md
5b6ccbb 
According to https://github.com/ossf/scorecard/blob/5758364c82f7fc72b256f9a8cfc89dc550d7dd66/docs/checks.md#security-policy

Ref #1298
@mumoshu mumoshu mentioned this issue May 10, 2022
Merged
mumoshu added a commit that referenced this issue May 10, 2022
@mumoshu
chore: Add signrel command for sigining arc release assets
b91acb2 
I used this command to sign assets for the recent releases to comply with the recommendation of https://github.com/ossf/scorecard/blob/5758364c82f7fc72b256f9a8cfc89dc550d7dd66/docs/checks.md#signed-releases

Ref Ref #1298
@mumoshu mumoshu mentioned this issue May 10, 2022
Merged
mumoshu added a commit that referenced this issue May 10, 2022
@mumoshu
chore: Add signrel command for sigining arc release assets
d8d50cc 
I used this command to sign assets for the recent releases to comply with the recommendation of https://github.com/ossf/scorecard/blob/5758364c82f7fc72b256f9a8cfc89dc550d7dd66/docs/checks.md#signed-releases

Ref #1298
toast-gear pushed a commit that referenced this issue May 11, 2022
@mumoshu
ci: pin GitHub Actions workflow actions by hash (#1422)
d01595c 
as recommended in https://github.com/ossf/scorecard/blob/5758364c82f7fc72b256f9a8cfc89dc550d7dd66/docs/checks.md#pinned-dependencies

Ref #1298
mumoshu added a commit that referenced this issue May 11, 2022
@mumoshu
Enable CodeQL Alerts following the OpenSSF Security Scorecards recomm…
854fbea 
…endation

Ref #1298
toast-gear pushed a commit that referenced this issue May 12, 2022
@mumoshu
ci: enable CodeQL Alerts following the OpenSSF Security Scorecards re…
b98f470 
…commendation (#1421)

Ref #1298
mumoshu added a commit that referenced this issue May 15, 2022
@mumoshu
Create SECURITY.md (#1424)
0e15a78 
* Create SECURITY.md

According to https://github.com/ossf/scorecard/blob/5758364c82f7fc72b256f9a8cfc89dc550d7dd66/docs/checks.md#security-policy

Ref #1298

* Update SECURITY.md
mumoshu added a commit that referenced this issue May 15, 2022
@mumoshu
chore: Add signrel command for sigining arc release assets (#1426)
bdbcf66 
* chore: Add signrel command for sigining arc release assets

I used this command to sign assets for the recent releases to comply with the recommendation of https://github.com/ossf/scorecard/blob/5758364c82f7fc72b256f9a8cfc89dc550d7dd66/docs/checks.md#signed-releases

Ref #1298

* Implement signrel subcommands for listing tags and signing assets, with docs
@mumoshu mumoshu mentioned this issue May 15, 2022
Merged
mumoshu added a commit that referenced this issue May 19, 2022
@mumoshu
Add CII Best Practices badge to README
456c020 
Ref #1298
This was referenced May 19, 2022
Merged
Merged
mumoshu added a commit that referenced this issue May 19, 2022
@mumoshu
Bump Go to 1.18.2
8204651 
As a part of #1298, I'm going to use Go fuzzing which is availabls since Go 1.18.
@mumoshu mumoshu mentioned this issue May 19, 2022
Merged
mumoshu added a commit that referenced this issue May 19, 2022
@mumoshu
Bump Go to 1.18.2
46b4819 
As a part of #1298, I'm going to use Go fuzzing which is availabls since Go 1.18.
mumoshu added a commit that referenced this issue May 19, 2022
@mumoshu
Add CII Best Practices badge to README
db570ce 
Ref #1298
toast-gear pushed a commit that referenced this issue May 19, 2022
@mumoshu
docs: Add CII Best Practices badge to README (#1461)
5366921 
Ref #1298
toast-gear added a commit that referenced this issue May 19, 2022
@mumoshu @toast-gear
Bump Go to 1.18.2 (#1462)
84210f3 
As a part of #1298, I'm going to use Go fuzzing which is availabls since Go 1.18.

Co-authored-by: Callum Tait <15716903+toast-gear@users.noreply.github.com>
mumoshu added a commit that referenced this issue May 19, 2022
@mumoshu
Add fuzzing to the test suite
2ec9bb9 
As a part of #1298, we add fuzzing based on Go test's fuzzing support to the test suite
@mumoshu mumoshu mentioned this issue May 19, 2022
Merged
mumoshu added a commit that referenced this issue May 19, 2022
@mumoshu
Add fuzzing to the test suite
1504882 
As a part of #1298, we add fuzzing based on Go test's fuzzing support to the test suite
toast-gear pushed a commit that referenced this issue May 19, 2022
@mumoshu
test: add fuzzing to the test suite (#1463)
3e988af 
As a part of #1298, we add fuzzing based on Go test's fuzzing support to the test suite
@mumoshu
Copy link
Collaborator

mumoshu commented May 22, 2022

We've managed to score 8.2 out of 10 now.

RESULTS
-------
Aggregate score: 8.2 / 10

Check scores:
|---------|------------------------|--------------------------------|-----------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------|
|  SCORE  |          NAME          |             REASON             |                                                  DETAILS                                                  |                                               DOCUMENTATION/REMEDIATION                                               |
|---------|------------------------|--------------------------------|-----------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------|
| 10 / 10 | Binary-Artifacts       | no binaries found in the repo  |                                                                                                           | https://github.com/ossf/scorecard/blob/5758364c82f7fc72b256f9a8cfc89dc550d7dd66/docs/checks.md#binary-artifacts       |
|---------|------------------------|--------------------------------|-----------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------|
| 8 / 10  | Branch-Protection      | branch protection is not       | Info: 'force pushes' disabled                                                                             | https://github.com/ossf/scorecard/blob/5758364c82f7fc72b256f9a8cfc89dc550d7dd66/docs/checks.md#branch-protection      |
|         |                        | maximal on development and all | on branch 'master' Info:                                                                                  |                                                                                                                       |
|         |                        | release branches               | 'allow deletion' disabled on                                                                              |                                                                                                                       |
|         |                        |                                | branch 'master' Info: settings                                                                            |                                                                                                                       |
|         |                        |                                | apply to administrators on                                                                                |                                                                                                                       |
|         |                        |                                | branch 'master' Info: status                                                                              |                                                                                                                       |
|         |                        |                                | checks require up-to-date                                                                                 |                                                                                                                       |
|         |                        |                                | branches for 'master' Info:                                                                               |                                                                                                                       |
|         |                        |                                | status check found to merge                                                                               |                                                                                                                       |
|         |                        |                                | onto on branch 'master' Warn:                                                                             |                                                                                                                       |
|         |                        |                                | number of required reviewers                                                                              |                                                                                                                       |
|         |                        |                                | is only 1 on branch 'master'                                                                              |                                                                                                                       |
|         |                        |                                | Info: Stale review dismissal                                                                              |                                                                                                                       |
|         |                        |                                | enabled on branch 'master'                                                                                |                                                                                                                       |
|---------|------------------------|--------------------------------|-----------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------|
| 9 / 10  | CI-Tests               | 29 out of 30 merged PRs        |                                                                                                           | https://github.com/ossf/scorecard/blob/5758364c82f7fc72b256f9a8cfc89dc550d7dd66/docs/checks.md#ci-tests               |
|         |                        | checked by a CI test -- score  |                                                                                                           |                                                                                                                       |
|         |                        | normalized to 9                |                                                                                                           |                                                                                                                       |
|---------|------------------------|--------------------------------|-----------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------|
| 5 / 10  | CII-Best-Practices     | badge detected: passing        |                                                                                                           | https://github.com/ossf/scorecard/blob/

I think it's the best we can do today.
Please raise another issue if you have more ideas.
Thanks!

@mumoshu mumoshu closed this as completed May 22, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
v0.24.0
Development

No branches or pull requests
2 participants
@mumoshu @laurentsimon