Enrich an SBOM using OSSF Security Score Card

[AyanSinhaMahapatra]

From @pombredanne

We already have SBOM export (and import) options in scancode.io supporting SPDX and CycloneDX
SBOMs, and we can enrich this data using the public https://github.com/ossf/scorecard#public-data
or the RestAPI at: https://api.securityscorecards.dev/.

• Add an addon pipeline to fetch and store OSSF Scorecard data #1282
• Store OSSF scorecard data in scancode.io models #1283
• Show OSSF scorecard data in the UI as quality data #1284
• Export OSSF scorecard data in SBOMs #1285

[tdruez]

We should implement this as a new pipeline. The enrich data can be included in the exports when available.

[rabajaj0509]

I am interested to work on this issue as part of the GSoC program 2023, how can I get more involved in the project?

[tdruez]

@rabajaj0509 https://scancodeio.readthedocs.io/en/latest/contributing.html is a good start.