Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improvement of OpenSSF Scorecard Score #6938

Open
1 of 5 tasks
harshitasao opened this issue Aug 16, 2024 · 3 comments
Open
1 of 5 tasks

Improvement of OpenSSF Scorecard Score #6938

harshitasao opened this issue Aug 16, 2024 · 3 comments

Comments

@harshitasao
Copy link
Contributor

harshitasao commented Aug 16, 2024

What is the underlying problem you're trying to solve?

Hi, I'm Harshita. I’m working with CNCF and the Google Open Source Security Team for the GSoC 2024 term. We are collaborating to enhance security practices across various CNCF projects. The goal is to improve security for all CNCF projects by both using OpenSSF Scorecards and implementing its security improvements.

Describe the ideal solution

As this project already has scorecard action, I'm here to increase the final score by going over each check. I've listed all of the checks where work needs to be done, in order of its criticality. I plan to submit each PR for each fix. Please let me know what you think and for which ones a PR is welcome that I will submit it ASAP.

Current Score: 6.9

Scorecard report: https://scorecard.dev/viewer/?uri=github.com/open-policy-agent/opa

Here's a few checks we can work on to improve the project's security posture:

  • Signed-Releases: Score = 0

    • The releases need to be signed; we can use cosign using github actions for that, and it will increase the score to 8. Additionally, SLSA provenance also needs to be added, which can be done using this, increasing the overall score to 10.
  • Token-Permissions: Score = 0

    • The issue here is that some workflows doesn’t have a top-level read-only permissions block like present in the other workflows.Scorecard is quite severe in this check: a single workflow without top-level permissions gets a 0/10 for the check.
    • PR: fixed the token-pemission issue #6941
  • Binary-Artifacts: Score = 4

  • Vulnerabilities: Score = 5

    • After running the osv scanner locally, a significant amount of vulnerabilities in Go dependencies were found that need to be fixed.
    • May need to add an osv-scanner.toml to mark some of these as not impacting/ignored.
    • Open vulnerabilities are easily exploited by attackers and should be fixed as soon as possible.
  • Pinned-Dependencies: Score = 8

    • Container images in dockerfile and go commands are not pinned by hash, which is resulting in a low score. But pinning these would introduce the risk of running outdated versions/images.
    • Pinning dependencies to a specific hash rather than allowing mutable versions or ranges of versions improves supply chain security.

/cc @joycebrum @diogoteles08 @pnacht @nate-double-u

@anderseknert
Copy link
Member

Hi @harshitasao 👋 and welcome back :) I'd say these would be welcome PR's right away:

  • Vulnerabilities
  • Pinned-Dependencies

The rest would likely need to be done in collaboration with @johanfylling , @ashutosh-narkar , and others, as there might be things to consider before making those changes.

@ashutosh-narkar
Copy link
Member

ashutosh-narkar commented Aug 16, 2024

Token-Permissions seems ok as well. This probably involves adding 👇 on the workflows unless I'm missing something here.

permissions:
  contents: read

Copy link

stale bot commented Sep 29, 2024

This issue has been automatically marked as inactive because it has not had any activity in the last 30 days. Although currently inactive, the issue could still be considered and actively worked on in the future. More details about the use-case this issue attempts to address, the value provided by completing it or possible solutions to resolve it would help to prioritize the issue.

@stale stale bot added the inactive label Sep 29, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants