✨ Support for detecting choco installer without required hash

[Alan-Jowett]

Signed-off-by: Alan Jowett [email protected]

What kind of change does this PR introduce?

Add support for detecting unpinned install using https://chocolatey.org/

• PR title follows the guidelines defined in our pull request documentation

What is the current behavior?

Scorecard ignores choco installs.

What is the new behavior (if this is a feature change)?**

Scorecard warns for choco installs with out required hash.

• Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

Fixes: #1807

Special notes for your reviewer

Does this PR introduce a user-facing change?

For user-facing changes, please add a concise, human-readable release note to
the release-note

(In particular, describe what changes users might need to make in their
application as a result of this pull request.)

Scorecard will issue a warning when installing packages using the Chocolatey installer but not pinning the install with a hash.

[github-actions]

Integration tests success for
[0ff239c]
(https://github.com/ossf/scorecard/actions/runs/2082599351)

[codecov]

Codecov Report

Merging #1810 (b7ef74c) into main (44ad5f5) will increase coverage by 3.15%.
The diff coverage is 85.29%.

@@            Coverage Diff             @@
##             main    #1810      +/-   ##
==========================================
+ Coverage   52.13%   55.28%   +3.15%     
==========================================
  Files          77       77              
  Lines        6823     6857      +34     
==========================================
+ Hits         3557     3791     +234     
+ Misses       3023     2815     -208     
- Partials      243      251       +8     

[naveensrinivasan]

Thanks!

[laurentsimon]

LG overall, thanks for the quick turnaround!
You just need to add a few more example in the files I provided in comment.

Thanks!

[github-actions]

Integration tests success for
[b4e304e]
(https://github.com/ossf/scorecard/actions/runs/2105572689)

[github-actions]

Integration tests success for
[dee6de5]
(https://github.com/ossf/scorecard/actions/runs/2105565636)

[github-actions]

Integration tests success for
[644ca64]
(https://github.com/ossf/scorecard/actions/runs/2167911938)

[github-actions]

Stale pull request message

[github-actions]

Integration tests success for
[b7ef74c]
(https://github.com/ossf/scorecard/actions/runs/2221448992)

[laurentsimon]

Merged! Congrats on the PR!

[github-actions]

Integration tests success for
[9d28e1b]
(https://github.com/ossf/scorecard/actions/runs/2221446814)