You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hi, I'm Harshita. I’m working with CNCF and the Google Open Source Security Team for the GSoC 2024 term. We are collaborating to enhance security practices across various CNCF projects. The goal is to improve security for all CNCF projects by both using OpenSSF Scorecards and implementing its security improvements.
As this project already has scorecard action, I'm here to increase the final score by going over each check. I've listed all of the checks where work needs to be done, in order of its criticality. I plan to submit each PR for each fix. Please let me know what you think and for which ones a PR is welcome that I will submit it ASAP.
The releases need to be signed; we can use cosign using github actions for that, and it will increase the score to 8. Additionally, SLSA provenance also needs to be added, which can be done using this, increasing the overall score to 10.
Integrating the project with OSS-Fuzz by following the instructions here. The most difficult one on the list, maintainers help, is highly appreciated. For example, helping in identifying the components where fuzz testing will be added.
Container images in dockerfile are not pinned by hash, which results in a low score. But pinning these would introduce the risk of running outdated images.
Pinning dependencies to a specific hash rather than allowing mutable versions or ranges of versions improves supply chain security.
signed releases: we have signed images already (see the code here). we don't sign the code itself yet
vulnerabilities: we have Snyk in place for this and it shows some vulnerabilities which we mostly cannot fix due to version compatibilities. also, many things are picked up from test files that don't affect the software itself and therefore can be ignored. do you have a report available from OSV scanner that i could check?
fuzzing: this is something that could be done
pinned deps: this is also something that could be done
Hi, I'm Harshita. I’m working with CNCF and the Google Open Source Security Team for the GSoC 2024 term. We are collaborating to enhance security practices across various CNCF projects. The goal is to improve security for all CNCF projects by both using OpenSSF Scorecards and implementing its security improvements.
As this project already has scorecard action, I'm here to increase the final score by going over each check. I've listed all of the checks where work needs to be done, in order of its criticality. I plan to submit each PR for each fix. Please let me know what you think and for which ones a PR is welcome that I will submit it ASAP.
Current Score: 7.9
Scorecard report: https://scorecard.dev/viewer/?uri=github.com/keptn/lifecycle-toolkit
Here's a few checks we can work on to improve the project's security posture:
Signed-Releases: Score = 0
Vulnerabilities: Score = 4
osv-scanner.toml
to mark some of these as not impacting/ignored.Fuzzing: Score = 0
Pinned-Dependencies: Score = 6
/cc @joycebrum @diogoteles08 @pnacht @nate-double-u
The text was updated successfully, but these errors were encountered: