Improvement of OpenSSF Scorecard Score

[harshitasao]

Hi, I'm Harshita. I’m working with CNCF and the Google Open Source Security Team for the GSoC 2024 term. We are collaborating to enhance security practices across various CNCF projects. The goal is to improve security for all CNCF projects by both using OpenSSF Scorecards and implementing its security improvements.

After the opening of the scorecard action addition PR, I'm here to increase the final score by going over each check. I've listed all of the checks where work needs to be done, in order of its criticality. I plan to submit each PR for each fix. Please let me know what you think and for which ones a PR is welcome that I will submit it ASAP.

Current Score: 6.2

Scorecard report: https://scorecard.dev/viewer/?uri=github.com/dragonflyoss/dragonfly2

Here's a few checks we can work on to improve the project's security posture [ in order of its criticality ]:

• [ ] Signed-Releases: Score = 0

  • The releases need to be signed; we can use cosign using github actions for that, and it will increase the score to 8. Additionally, SLSA provenance also needs to be added, which can be done using this, increasing the overall score to 10.

• [X] Token-Permissions: Score = 0

  • The issue here is that many workflows doesn’t have a top-level read-only permissions block like present in the other workflows. Scorecard is quite severe in this check: a single workflow without top-level permissions gets a 0/10 for the check.
  • PR: https://github.com/dragonflyoss/Dragonfly2/pull/3442

• [X] Vulnerabilities: Score = 9

  • Affected package: github.com/aws/aws-sdk-go (https://osv.dev/GO-2022-0646)
  • PR: https://github.com/dragonflyoss/Dragonfly2/pull/3443

• [ ] Fuzzing: Score = 0

  • Integrating the project with OSS-Fuzz by following the instructions here. The most difficult one on the list, maintainers help, is highly appreciated. For example, helping in identifying the components where fuzz testing will be added.

• [X] Pinned-Dependencies: Score = 0

  • Github actions and container images in Dockerfile are not pinned by hash, which is resulting in a low score.
  • Pinning dependencies to a specific hash rather than allowing mutable versions or ranges of versions improves supply chain security.
  • PR: https://github.com/dragonflyoss/Dragonfly2/pull/3442

• [ ] CII-Best Practices: Score = 0

  • This check determines whether the project has earned an OpenSSF (formerly CII) Best Practices Badge at the passing, silver, or gold level. The OpenSSF Best Practices badge indicates whether or not that the project uses a set of security-focused best development practices for open source software.
  • To remediate the check, sign up for the OpenSSF Best Practices program.
  • NOTE: This can only be done by mainatiner of the project.

/cc @joycebrum @diogoteles08 @pnacht @nate-double-u

[harshitasao]

cc @yxxhero

[angellk]

Thank you for opening this @harshitasao - have any PR's been opened in reference to your suggestions? Cc: @gaius-qi

[gaius-qi]

@harshitasao Hey! I have finished the Singed-Releases, Token-Permissions and Pinned-Dependencies. cc @angellk

• Singed-Releases: https://github.com/dragonflyoss/Dragonfly2/releases/tag/v2.1.57
  • https://github.com/dragonflyoss/Dragonfly2/pull/3516
  • https://github.com/dragonflyoss/Dragonfly2/pull/3514
• Token-Permissions: https://github.com/dragonflyoss/Dragonfly2/pull/3518
• Pinned-Dependencies: https://github.com/dragonflyoss/Dragonfly2/pull/3518

I have two questions:

1. Dragonfly has CII-Best Practices, refer to https://bestpractices.coreinfrastructure.org/projects/7103. How can I get scores?

2. I have finished the Singed-Releases, Token-Permissions and Pinned-Dependencies. But the OpenSSF Scorecard report is not updated. Still the report of 2024-09-09, refer to https://scorecard.dev/viewer/?uri=github.com/dragonflyoss/dragonfly2.

[pnacht]

Hey @gaius-qi, I just noticed the badge has a small typo: the Scorecard API is case-sensitive, and the badge is being pulled for dragonflyoss/dragonfly2*, not for dragonflyoss/Dragonfly2. If you modify that, you'll get the "correct" score of 7.8.

As for the "Best Practices badge", it is currently being picked up as "in progress" by Scorecard. This seems to be because there are two "projects" registered in the Best Practices site for Dragonfly2:

• https://www.bestpractices.dev/en/projects/6851 ("in progress")
• https://www.bestpractices.dev/en/projects/7103 ("passing")

Scorecard seems to be picking up the first "project". You are listed as the "owner" for both projects, so you should be able to log into the platform, open project 6851 and delete it (there'll be a big "Delete" button on the top of the page when you open the project). That should let Scorecard "find" project 7103 which is passing.

---

* The dragonflyoss/dragonfly2 score is probably calculated by Scorecard's weekly cronjob, where the repo was probably registered in the lower-case style.

[gaius-qi]

Hey @gaius-qi, I just noticed the badge has a small typo: the Scorecard API is case-sensitive, and the badge is being pulled for dragonflyoss/dragonfly2*, not for dragonflyoss/Dragonfly2. If you modify that, you'll get the "correct" score of 7.8.

As for the "Best Practices badge", it is currently being picked up as "in progress" by Scorecard. This seems to be because there are two "projects" registered in the Best Practices site for Dragonfly2:

• https://www.bestpractices.dev/en/projects/6851 ("in progress")
• https://www.bestpractices.dev/en/projects/7103 ("passing")

Scorecard seems to be picking up the first "project". You are listed as the "owner" for both projects, so you should be able to log into the platform, open project 6851 and delete it (there'll be a big "Delete" button on the top of the page when you open the project). That should let Scorecard "find" project 7103 which is passing.

• The dragonflyoss/dragonfly2 score is probably calculated by Scorecard's weekly cronjob, where the repo was probably registered in the lower-case style.

@pnacht Thanks! I have rename dragonflyoss/dragonfly2 to dragonflyoss/Dragonfly2 and delete the Best Practices in progress, refer to https://www.bestpractices.dev/en/projects/6851.