-
Notifications
You must be signed in to change notification settings - Fork 418
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[#1554] Fix code scanning alert - Pinned-Dependencies
Closes #1554
- Loading branch information
Showing
2 changed files
with
17 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
87ff7a6
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi @remkop happy to see you trying out
harden-runner
. You get a report of the outbound calls and insights in a link in the build log, e.g.https://github.com/remkop/picocli/runs/5002447373?check_suite_focus=true#step:3:5
You can then use the recommended policy. I am curious if there was a reason you did not use the policy in
block
mode?Also, I am building automation to make it easy to meet scorecard requirements. Please let me know if you have feedback on that, or if there were pain points that can be automated...Thanks!
87ff7a6
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi @varunsh-coder, thank you for reaching out!
I basically used StepSecurity's online tool: copy-and-pasted my GitHub action CI workflow config file, checked that the result was not obviously bad, and used that as my new config.
I just used what was suggested by the tool. I will take a look at the
block
policy, I haven't looked in detail at what each of these policies do yet.Regarding feedback/pain points:
Finally, thank you for your work on this. I was impressed by how easy StepSecurity's online tool made it to fix the Pinned Dependencies item! Great work!
87ff7a6
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I thought of two more things (related to the openssf dashboard):
87ff7a6
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ok, whenever you check it out, feel free to tag me if you have feedback.
@laurentsimon - hope you don't mind me adding you to this thread. I do not know what is the source of this ossf dashboard. Where should these issues be reported?
Yes, I think this is fair feedback. Lot of open source projects are maintained by a single maintainer. @laurentsimon - FYI. Please let me know if want me to create an issue for this or may be this is already tracked?
Thanks @remkop, to clarify I am the founder of StepSecurity, I am not a scorecards maintainer, but I work with @laurentsimon and others who maintain scorecards...
87ff7a6
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
the OSSF dashboard currently does not refresh using the results of the scorecard action analysis. We are working on it actively and will also launch a scorecard.dev website soon with that information. Thank you for your patience.
@azeemshaikh38 @inferno-chromium @scovetta @david-a-wheeler
Thank you @remkop for the feedback. You are receiving credits for enabling branch protection. I ran scorecard manually and your score for branch protection is
8
, which is as good as it gets. We still provide the results to get to10
, but we understand those criteria cannot be met by everyone. You can ignore the remaining alerts for branch protection.Please let me know if there's a problem with the messaging in the results that we could improve. I think the main issue is that the OSSF dashboard does not reflect the results. Is there another place we could improve?
cc @olivekl
87ff7a6
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sorry, I had missed this feedback. As per scorecards
"The check currently looks for GitHub packaging workflows and language-specific GitHub Actions that upload the package to a corresponding hub, e.g., Npm. We plan to add better support to query package manager hubs directly in the future, e.g., for Npm, PyPi."
My understanding is that since you do not have a packaging workflow in the repo that publishes to maven, this is not showing up on the dashboard.
As per scorecards,
"This check looks for the following filenames in the project's last five releases: *.minisig, *.asc (pgp), *.sig, *.sign."
@remkop I see that you publish
.jar
files in releases, but not the.asc.sha256
file. Not sure if consumers will use the signed file, but also publishing the signature files in the release assets, will make it equivalent to what is published to maven central. @laurentsimon I observed the extension for signed file is.asc.sha256
in this case. So even if they were published, it would not get detected by the check...87ff7a6
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
that's correct. Currently it's hard to map a package name back to its repo, so we're only looking for workflows that build the package. In your case, we're looking for the use of
actions/setup-java
action ormvn [...] deploy
commands. Is the a reasonable assumption?Great, I've created a tracking issue on scorecard repo ossf/scorecard#1582. Can you confirm
.asc.sha256
is the standard extension for maven's signed packages? Is it fair to expect maintainers to add this to their GitHub release? Please comment on the issue for additional information how we should implement this.87ff7a6
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I see! I was publishing releases manually from my PC. I now realize that the tool relies on the GitHub Action workflow config file to find/map packages. So, for the scorecard toolchain to detect the packages, the GitHub Action workflow would need to do the publishing, perhaps triggered by me pushing a release tag. I guess that makes sense, I can try that.
Ok will do.
87ff7a6
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Understood. No worries! 😄
Can you let me know how I can impact the Summary and Detected URLs on the ossf dashboard? How is this retrieved? Is there some file I need to add, or some setting to add to a GitHub Action configuration?
I see. Thank you for checking that!
You are correct, I did not like having to Dismiss the branch protection alert as "false positive" in the end after making those changes. It felt that I had not accomplished anything, but with hindsight that is because I did not have the feedback that the branch protection score would show up as 8 on the ossf dashboard after the next refresh.
Yes, as you suggest, one idea to improve this is to show the current score in the alert messages, if that is feasible. 🤔
87ff7a6
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
awesome!
Unfortunately not. Once we have scorecard.dev website up and running, the data will automatically show up there. We're also preparing a badge system to display on your readme.
Can you create a tracking issue? This is do-able and we should have done it earlier. I think we can have this done in the next minor release. Thanks for the suggestion!
87ff7a6
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I've created the issue ossf/scorecard#1592 and sent a PR ossf/scorecard#1593 to address it.