Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improvement of OpenSSF Scorecard Score #1087

Open
2 of 7 tasks
harshitasao opened this issue Aug 16, 2024 · 0 comments
Open
2 of 7 tasks

Improvement of OpenSSF Scorecard Score #1087

harshitasao opened this issue Aug 16, 2024 · 0 comments

Comments

@harshitasao
Copy link
Contributor

harshitasao commented Aug 16, 2024

Hi, I'm Harshita. I’m working with CNCF and the Google Open Source Security Team for the GSoC 2024 term. We are collaborating to enhance security practices across various CNCF projects. The goal is to improve security for all CNCF projects by both using OpenSSF Scorecards and implementing its security improvements.

After the opening of the scorecard action addition PR, I'm here to increase the final score by going over each check. I've listed all of the checks where work needs to be done, in order of its criticality. I plan to submit each PR for each fix. Please let me know what you think and for which ones a PR is welcome that I will submit it ASAP.

Current Score: 4.9

Scorecard report: https://scorecard.dev/viewer/?uri=github.com/cloudevents/sdk-go

Here's a few checks we can work on to improve the project's security posture [ in order of its criticality ]:

  • Token-Permissions: Score = 0

    • The issue here is that many workflows doesn’t have a top-level read-only permissions block like present in the other workflows. Scorecard is quite severe in this check: a single workflow without top-level permissions gets a 0/10 for the check.
    • PR: Fixed the token-permission issue  #1088
  • Vulnerabilities: Score = 0

    • After running the osv scanner locally, a significant amount of vulnerabilities in Go dependencies were found that need to be fixed.
    • May need to add an osv-scanner.toml to mark some of these as not impacting/ignored.
    • Open vulnerabilities are easily exploited by attackers and should be fixed as soon as possible.
  • Security-Policy: Score = 0

    • This check tries to determine if the project has published a security policy. It works by looking for a file named SECURITY.md (case-insensitive) in a few well-known directories.
    • To remediate this check, Please follow this
  • Fuzzing: Score = 0

    • Integrating the project with OSS-Fuzz by following the instructions here. The most difficult one on the list, maintainers help, is highly appreciated. For example, helping in identifying the components where fuzz testing will be added.
    • Issue: Add fuzz-testing #1091
  • SAST: Score = 0

    • Running the CodeQL checks in the CI/CD by following the instructions here.
  • Pinned-Dependencies: Score = 1

    • Github actions are not pinned by hash, which is resulting in a low score.
    • Pinning dependencies to a specific hash rather than allowing mutable versions or ranges of versions improves supply chain security.
    • PR: Fixed the pinned dependencies #1089
  • CII-Best Practices: Score = 0

    • This check determines whether the project has earned an OpenSSF (formerly CII) Best Practices Badge at the passing, silver, or gold level. The OpenSSF Best Practices badge indicates whether or not that the project uses a set of security-focused best development practices for open source software.
    • To remediate the check, sign up for the OpenSSF Best Practices program.
    • NOTE: This can only be done by mainatiner of the project.

/cc @joycebrum @diogoteles08 @pnacht @nate-double-u

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant