From cc6fea8085e9bba4ffeb384b05c070c5e42ec6f1 Mon Sep 17 00:00:00 2001 From: Clayton Kehoe <118750525+kehoecj@users.noreply.github.com> Date: Wed, 29 May 2024 16:32:08 -0500 Subject: [PATCH] Improve Scorecard scores (#152) * add openssf best practices badge * adding security * remove binary file * improving workflow security * addings SHAs to base containers * fixing workflows * fixing workflows * updating security text --- .github/workflows/go.yml | 39 ++++++++++++++++++++++------ .github/workflows/golangci-lint.yml | 19 +++++++++----- .github/workflows/release.yml | 26 ++++++++++++++----- .github/workflows/scorecard.yml | 5 ++++ .gitignore | 1 + Dockerfile | 4 +-- README.md | 4 +++ SECURITY.md | 9 +++++++ bin/validator | Bin 8250354 -> 0 bytes index.md | 4 +++ 10 files changed, 88 insertions(+), 23 deletions(-) create mode 100644 SECURITY.md delete mode 100755 bin/validator diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml index 26ce2443..edabd2ff 100644 --- a/.github/workflows/go.yml +++ b/.github/workflows/go.yml @@ -11,14 +11,22 @@ on: - main pull_request: +permissions: + contents: read + jobs: download: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Set up Go - uses: actions/setup-go@v4 + uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: go-version: '1.22' @@ -29,10 +37,15 @@ jobs: needs: download runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Set up Go - uses: actions/setup-go@v4 + uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: go-version: '1.22' @@ -46,10 +59,15 @@ jobs: needs: download runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - name: Harden Runner + uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0 + with: + egress-policy: audit + + - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6 - name: Set up Go - uses: actions/setup-go@v4 + uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: go-version: '1.22' @@ -65,12 +83,17 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: fetch-depth: 0 # otherwise, there would be errors pushing refs to the destination repository. - name: Set up Go - uses: actions/setup-go@v4 + uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: go-version: '1.22' diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml index 5c3ff44b..203e826b 100644 --- a/.github/workflows/golangci-lint.yml +++ b/.github/workflows/golangci-lint.yml @@ -10,8 +10,6 @@ permissions: contents: read # Optional: allow read access to pull request. Use with `only-new-issues` option. pull-requests: read - # Optional: Allow write access to checks to allow the action to annotate code in the PR. - checks: write jobs: golangci: @@ -19,16 +17,25 @@ jobs: matrix: go: ['1.21'] os: [ubuntu-latest, macos-latest, windows-latest] + permissions: + # Optional: Allow write access to checks to allow the action to annotate code in the PR. + checks: write + name: lint runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v4 - - uses: actions/setup-go@v5 + - name: Harden Runner + uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0 + with: + egress-policy: audit + + - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6 + - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1 with: go-version: ${{ matrix.go }} cache: false - name: golangci-lint - uses: golangci/golangci-lint-action@v4 + uses: golangci/golangci-lint-action@d6238b002a20823d52840fda27e2d4891c5952dc # v4.0.1 with: # Require: The version of golangci-lint to use. # When `install-mode` is `binary` (default) the value can be v1.2 or v1.2.3 or `latest` to use the latest version. @@ -48,4 +55,4 @@ jobs: # only-new-issues: true # Optional:The mode to install golangci-lint. It can be 'binary' or 'goinstall'. - # install-mode: "goinstall" + # install-mode: "goinstall" \ No newline at end of file diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 131b091b..13021865 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -9,8 +9,7 @@ env: IMAGE_NAME: ${{ github.repository }} permissions: - contents: write - packages: write + contents: read jobs: releases-matrix: @@ -26,9 +25,17 @@ jobs: - goarch: arm64 goos: windows + permissions: + packages: write + steps: - - uses: actions/checkout@v3 - - uses: wangyoucao577/go-release-action@v1 + - name: Harden Runner + uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - uses: wangyoucao577/go-release-action@8fa1e8368c8465264d64e0198208e10f71474c87 # v1.50 with: github_token: ${{ secrets.GITHUB_TOKEN }} goos: ${{ matrix.goos }} @@ -46,15 +53,20 @@ jobs: strategy: matrix: include: - - base: "alpine:3.19" + - base: "alpine:3.19@sha256:c5b1261d6d3e43071626931fc004f70149baeba2c8ec672bd4f27761f8e1ad6b" postfix: "" - base: "scratch" postfix: "-scratch" - - base: "ubuntu:20.04" + - base: "ubuntu:20.04@sha256:874aca52f79ae5f8258faff03e10ce99ae836f6e7d2df6ecd3da5c1cad3a912b" postfix: "-ubuntu" steps: - - uses: actions/checkout@v3 + - name: Harden Runner + uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0 + with: + egress-policy: audit + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Log in to the Container registry uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1 with: diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 4aff901f..5eccf0be 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -29,6 +29,11 @@ jobs: id-token: write steps: + - name: Harden Runner + uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0 + with: + egress-policy: audit + - name: "Checkout code" uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 with: diff --git a/.gitignore b/.gitignore index 0bf8954f..e859c130 100644 --- a/.gitignore +++ b/.gitignore @@ -5,6 +5,7 @@ *.so *.dylib cmd/validator/validator +bin/ # Test binary, built with `go test -c` *.test diff --git a/Dockerfile b/Dockerfile index 8f875476..1bbe3383 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ -ARG BASE_IMAGE=alpine:3.19 +ARG BASE_IMAGE=alpine:3.19@sha256:c5b1261d6d3e43071626931fc004f70149baeba2c8ec672bd4f27761f8e1ad6b -FROM golang:1.22 as go-builder +FROM golang:1.22@sha256:f43c6f049f04cbbaeb28f0aad3eea15274a7d0a7899a617d0037aec48d7ab010 as go-builder ARG VALIDATOR_VERSION=unknown COPY . /build/ WORKDIR /build diff --git a/README.md b/README.md index 38c27929..fafd19a4 100644 --- a/README.md +++ b/README.md @@ -11,6 +11,10 @@ OpenSSF Scorecard + + + + Apache 2 License diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..c757b597 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,9 @@ +# Reporting Security Issues + +The config-file-validator admins and community take security bugs in the config-file-validator project seriously. We appreciate your efforts to responsibly disclose your findings, and will make every effort to acknowledge your contributions. + +To report a security issue, please use the GitHub Security Advisory ["Report a Vulnerability"](https://github.com/boeing/config-file-validator/security/advisories/new) tab. + +The config-file-validator admins will send a response indicating the next steps in handling your report. After the initial reply to your report, the security team will keep you informed of the progress towards a fix and full announcement, and may ask for additional information or guidance. + +Report security bugs in third-party modules to the person or team maintaining the module. \ No newline at end of file diff --git a/bin/validator b/bin/validator deleted file mode 100755 index c43fed2d254c9e0c9601e479d001060d0a55c061..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 8250354 zcmeF4dwf;ZmH79$k31j>mMB!f+&mybRA^BkrEP8=yhMYQ%;=O(^SA+mD2V6?1)B>A z4-HnXX2uq5dBh-zk5Y=&w6%nXh)`Pyj_tJ5@!p$+hq0}pw#`*ye&2N-_nurHwKKoZ z{5AP}PR=>|?7jBdYpuQZT5CVyDOGmUi|jg($Zxs?yFdGZ|SlJAF2R_czFIp**b9^G=a#w;A8zI zneYb#Zuiyebsu4|tcu3qGv4f8MjV0phBe!|xrI-CK=R&(neI^Fyet}qgLmp}hgV4@cb6VjXq`NkUnVtGus;l8joM=tN*OSYyCp3lpVi#cp@ju4LP|h|ITT# zLh9=}oM?jgF8#4#+;!0;d9b=mY3VmA=T$tkptQWA;(>YpB7D6lys;JnCOjK3JDVwQ z!lTR1BU3!Qv6_M3C-V%tjmA$H z+y#{trOSK|ER2Vj^z(T-yz5OUNhx-zy%;>Ry+${?0Kd-^BWr zq-T&mULJsZ{3%TxAM&ue!xCaikNXp(1&(Lq6P9ic#kgtGogQBD zz@la23YR=EZ`zWF7NbBHE?In&-qGaCxPP4Yz%o*njmwYA1AM`+?C+~*&OF~k4=j9e z#l>r|z5-MJMskULvhD0Db>~Nt@_&E-M}hyN!2eO;|0wXkL4iKc^d%nMfAGvK`hq8; zsQC8Mr7Ozs&A+wyj?dp;u&8L(%zqd+tEl|;sRa*~S53Zi=I#G9bMfp+lW!jP)!QoX zoP`VML* zKAi1t>Rp-8)LWwk{^V56Ny`73GlNu1Xo3oaGgY8W`S1Mb{p9-dT%T}#NS!i#NmAa*O<+P>` zXHRVcmq4qt^qnC2Q_26~?4N;`*3=7(Aqv<@-pFan9Jxsy*It_%2~uyEyx7R~7$|MM zEAxSKV3)u!^0*@!=?zMy_8nBT6Id%9v{MCU~u8$1zd&p7JlCW*K5J` zBf%B?Le6WTueYG%>qp6o$ zfr~Xr8{qE;R|b}nuME6%kn5_iIwMl|44!v=vUP)1-y-syRBCTuqKXJV%N%*{2v3l0 zL{ns~kaiTn7ux4Ecv3~3u756!9HLwZ8cIIo{7xr#ze;;Yq4=%O_4 z^|d5<-@mU%Z{ub9+DBcszNS)j-t~|s>7ta9TwdfYsW}5YhESK1ey`uow>e z>&HUBcPJ};@d|L2ekL@0o3vdHb*$Bo(n}@WW5~h9XP!&3#S1^bJdwIN<|M)F$O094L4D@02$D0aynG zp840i^2d6aKh1GB{dumd>90O#Q)H2&>EmTulhpqqeKkm*^&@X0b006u=X(M93dvv8 z^rtyfY0u$kJ2nmUM*4i?yWVuFl1~O**V9{**3+A*PRt#vHkA*}kI21ZNPZ+uXM^Z1t#acwSOILhVlX4-8CMUfEOT zOnb-W(E^{L-@23*z_&?t1yun5G1cYO0{By@t}-nkdRNku%sXDN{#|sOt5pT0-*H0I1t`=`KZIb}@!%$2yP^;j>$5b-om>uEx>xN+aK^mDb&; zytzAvd7nJ!Ik?$3e(UB6<)|C=N#3MVmx1@{ByVosDs5?K=+@0b^APn!@iyyP|4Y?R z_U4-SpRnQIbQ%1G$A&C_`Zl!FhMi^`4%3D=XhXZL4Wns;w0Vuz^UAg)v3b<7YUSv{ z_9%(+-^AYwEr0Z=R{uKJUamQD?a4OV^OmhWGn4xB!vPL!RMJGDkMQKb(^($mv2AIjR!t-kYT&KI-cNrVp5f$-tbVBKv`NgG#E~s12ywc!dhos_H$$!}r0Z zqgu;-f4YkJKdU|<>O*@{bbWNgm$dr!>ipbF^~j#i=L&O)y**GfxMp)`x;G+Y!`T#c z+FTWJDwUh*QYSi`&SSObtDmY>=wPMlIt#rKqn{*nRlL1+b2~JsR<5of{lL(L&gL3) zTyU;8A}}R?19FpxEF4T$C0WXStTsuV=ybY{`OdF>%qKACcq99Ov151b=8gs4$X4>U z>hPTCR#)>98@%vrZ)8n^+S@)w@O5^zC#aH+S>DJfde-SQ z?fyh?a5tZN0U8P)&3jnC8{_jE`g2lqzUFT`WP9GPKPT$xKeIjmM1M|ePEW-?{`O~( zM+altzwCK^i29&$*NuTwiQYXGPJi3gv$XojSxUDn4Y?T}=sB+H^>W8=34{lJa}Rp& zg0iA(6DT_-uIyRLO5c!iC^V41IS4urQIU=YmD~B8$`!k!V~5etL-gzLAZR=U8aH_P z?#*@E^y8!W3ik1E6Ztl|)XRRS+AB6>ygh_0cl{nZFEs5T7q(DARb`J4n@9S)$od$@ z?;^?;k`_kJ#4eM5Y#&#RaYQxW0}b!vdS*ndO@jYk6aRO>^(t)o4;xfqtK+J!{Ez!e zKFm~sRELWE%BI8O?WO3rZrVy3wvv5Zyp+AP5ZvSGaX-G$aGa?>_Vzv9uMN;&aDCLo z^^bA5mgARNxPD;6RTS?32EGR`f$u;6H}J(KZ^0jHVeDD79~wE5yel%f