add osv-scanner to ignore false positives thrown by OpenSSF Scorecard #56100
Conversation
- This file is used to ignore particular vulnerabilities reported Open Source Vulnerability database (https://osv.dev/) - The specification for this particular file can be found at (https://google.github.io/osv-scanner/configuration/) as of 2024-01-04
There was a problem hiding this comment.
Thank you for opening this followup which is arguably less intrusive.
It looks to me as if this potentially opens up a box of things to consider and invest into. I am not familiar with the OpenSSF Scorecard and therefore currently cannot comment on if this is desirable. If it is, it also opens the question about who does this, I see you already started @gregorywaynepower (thanks!) can we expect continued involvement?
What would be the next steps?
|
@gregorywaynepower is this good to go now? Can you the merge conflicts? |
|
@nyalldawson I'll handle the merge conflicts and do another pass on the OpenSSF Best Practices badge so the score isn't sitting at 22%. |
|
@nyalldawson Merge conflicts managed, you should be good to go. |
|
@gregorywaynepower Thanks for the updates (we now have 22% to cover instead of being at 22% 😃). About https://www.bestpractices.dev/fr/projects/1581, afaict all the official pages we handle are https (website, downloads, user manuals, APIs, plugins, github...) so there is a missing checkbox in the General group. And the URL of the website should be https. |
|
Thanks!
|
|
I just ran the the OpenSSF's CLI Tool against master at 472ce88 and your score should be an 8/10 for Branch-Protection. Here's the new summary report and your aggregate score is 8.1/10: ScoreCardCLI_Report.txt Along with the specifics for how you have the 8/10 score: ScoreCardCLI_Report_Branch_Protection.txt Here's the settings they expect if you want to get a 10/10 for Branch-Protection. I'd expect this to be more up-to-date when y'all add the OpenSSF's Scorecard GitHub action, but that'll be a separate and more involved pull-request. |
Woops, I didn't realize that the third question under Basics had an http link. I've fixed that and we're at 79%! |
Sorry for taking so long on this @m-kuhn! It looks like it may be an issue with permissions associated with the Github Action. |
Hello @elpaso @haubourg @DelazJ ,
This is a simplification of pull request #55748 and does not include the addition of the Open Source Security Foundation's Github Action. I think adding that action would be a separate pull request.
TLDR: