Improvement of OpenSSF Scorecard Score

[harshitasao]

Summary

Hi, I'm Harshita. I’m working with CNCF and the Google Open Source Security Team for the GSoC 2024 term. We are collaborating to enhance security practices across various CNCF projects. The goal is to improve security for all CNCF projects by both using OpenSSF Scorecards and implementing its security improvements.

As this project already has scorecard action, I'm here to increase the final score by going over each check. I've listed all of the checks where work needs to be done, in order of its criticality. I plan to submit each PR for each fix. Please let me know what you think and for which ones a PR is welcome that I will submit it ASAP.

Current Score: 8.4

Scorecard Report: https://scorecard.dev/viewer/?uri=github.com/argoproj/argo-cd

Here's a few checks we can work on to improve the project's security posture:

• [X] Vulnerabilities: Score = 0

  • After running the osv scanner locally, some vulnerabilities in Go and UI dependencies were found that need to be fixed.
  • Open vulnerabilities are easily exploited by attackers and should be fixed as soon as possible.
  • May need to add an osv-scanner.toml to mark some of these as not impacting/ignored.
  • PR: https://github.com/argoproj/argo-cd/pull/19576

• [ ] Pinned-Dependencies: Score = 7

  • The dependencies have almost all the container images pinned by hash; the scorecard report is also showing that go and npm need to be pinned by hash, but pinning those would introduce the risk of running outdated versions.

• [ ] Fuzzing: Score = 0

  • I can see fuzzers in the cncf/fuzzing repo for argo-cd, and it is also integrated with OSS-Fuzz, but the fuzzing score remains 0. I am not sure why this is happening. Help from maintainers will be highly appreciated.

/cc @joycebrum @diogoteles08 @pnacht @nate-double-u

[crenshaw-dev]

I can see fuzzers in the cncf/fuzzing repo for argo-cd, and it is also integrated with OSS-Fuzz, but the fuzzing score remains 0. I am not sure why this is happening. Help from maintainers will be highly appreciated.

I've wondered about this myself. I assume it has something to do with how the OpenSSF Scorecard calculates the fuzzing score.

[pnacht]

I've taken a look at this issue and it has to do with argo's setup in OSS-Fuzz.

Specifically, Scorecard identifies that a project is fuzzed by OSS-Fuzz by comparing its URL to the main_repo registered in project.yaml. In argo's case, that is main_repo: "https://github.com/argoproj", not [...]/argoproj/argo-cd.

From what I can tell, the main_repo is pointing to the org because the logic in https://github.com/google/oss-fuzz/blob/master/projects/argo actually fuzzes multiple different repositories at the same time.

This setup works well for the project and I in no means suggest changing it. But it unfortunately means Scorecard can't detect it. And there's currently no "workaround" to correct the Scorecard score for this, I'm afraid.

That being said, Scorecard will soon release a new major version (v5.0) that will include a new feature called "Maintainer annotations", which are meant to mitigate precisely this sort of issue. These annotations will allow maintainers to inform users that "hey, Scorecard didn't quite understand what's going on here".

[harshitasao]

@crenshaw-dev should I proceed with the PR for this?