Feature: incorporate CLOMonitor-style exemptions

[lizrice]

As a CNCF project we've been encouraged to add both CLOMonitor and OpenSSF Scorecard badges, and there's quite a lot of overlap between the security-related checks that CLOMonitor runs, and the Scorecard checks. We reviewed the results from CLOMonitor and found some false positives, for which we've been able to document exemptions so that they don't appear as failed tests. (We really don't want to display a badge that portrays the project as a lot less secure than it really is!)

It would be great if those same exemptions could be pulled in by Scorecard as well. Ideally there would be just one exemptions file per repo acting as the source of truth (i.e. scorecard could re-use the checks that it finds in a .clomonitor file).

[laurentsimon]

Hey, we've been thinking of creating a config file as well. Thanks for the link, I was not aware of CLOMonitor. Is it a CNCF project?

[lizrice]

Yes: https://github.com/cncf/clomonitor

[lizrice]

Seems that CLOmonitor pulls in the tests from Scorecards, so maybe that's where the exemptions should live too. Would be great if the schema for documenting those exemptions could be reused though to save reinventing the wheel

[github-actions]

Stale issue message - this issue will be closed in 7 days

[lizrice]

Can I reopen this to get comment from the team?

[spencerschrock]

Hmm, thought we had disabled the auto close in #3493

[spencerschrock]

@gabibguti something to consider with the maintainer annotation work

[github-actions]

This issue is stale because it has been open for 60 days with no activity.

[sandipanpanda]

Hi, have there been any updates on this issue? I am working on adding the OpenSSF Scorecard badge to Cilium README, and fixing this would help address the issues mentioned here.

cc @spencerschrock

[spencerschrock]

Hi, have there been any updates on this issue? I am working on adding the OpenSSF Scorecard badge to Cilium README, and fixing this would help address the issues mentioned here.

It's on our roadmap for this quarter. We haven't entirely decided how this will display in terms of the badge.

[github-actions]

This issue has been marked stale because it has been open for 60 days with no activity.

[justaugustus]

FYI @caniszczyk

[caniszczyk]

cncf/clomonitor#1466

[justaugustus]

For those tracking this issue, we're getting conversations on the books with the CLOMonitor maintainers to decide on the best integration path for folks leveraging either or both tools.

Stay tuned!

[github-actions]

This issue has been marked stale because it has been open for 60 days with no activity.