-
Notifications
You must be signed in to change notification settings - Fork 474
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
"Signed-Releases" check scores above 10 leading to invalid scores #3766
Comments
Likely introduced by #3610, specifically #3610 (comment) |
FWIW, running the Scorecard CLI on the project returns a normal 10/10 for Signed-Releases. In fact, using the Scorecard Viewer, the score is normalized as well: https://securityscorecards.dev/viewer/?uri=github.com/urllib3/urllib3 The difference is that deps.dev uses the result from the weekly cronjob, which runs closer to HEAD and ran on Dec 25th, while the Scorecard viewer also accepts the results from your Scorecard Action, which runs an official release of Scorecard (not sure which version, precisely) and ran today. |
Note: the |
Among the weekly data, 79 / 1,244,612 repos (0.006%) have a Signed-Releases score greater than 10. Although the number of affected repos may be slightly higher, as this doesn't count the ones who have an inflated yet still valid score. |
Leaving this open while discussing options around deps.dev and BQ data. Although given the small number of repos affected, the answer may be to just wait. |
Closing since new data has propagated to deps.dev at this point. |
See urllib3's current score for "Signed-Releases" of 40/10: https://deps.dev/pypi/urllib3, this also affects our total score which is above 10.
The text was updated successfully, but these errors were encountered: