Scorecard Bi-weekly: Feb 24th 2022

[azeemshaikh38]

@naveensrinivasan updates:

• Porting the Scorecards action to go with high tests coverage
• Currently many in shell; porting to golang will allow for test coverage (yay!)
• Builds are parallel
• Scorecard v4.1.0 released
  • SA: Is the release process documented?
  • Nope, not yet
  • SA will add to the docs punchlist
• Scorecard dependabot Vulnerability issue addressed
  • Non-issue, but dealt with so it won’t come up again
• Codecoverage tracking enabled for Scorecards action

@justaugustus updates:

• Created a project board
  • Walkthrough of Github project boards
• Copyright? (issue Handling dates in copyright headers #1534)
  • Year? VMB: Not needed
  • “OpenSSF authors” ? “Scorecard authors” ?
  • VMB: Ask the LF lawyers which it should be

HardenRunner demo (@varunsh-coder):

• Demo of https://github.com/step-security/harden-runner.
  • Purpose built agent for build servers
  • Security monitoring of the build server (runner)
  • Currently runs against the runner on Github’s CI
  • Installs an agent on the runner VM then monitors all outbound calls
  • Can set policy to restrict outbound endpoints
  • Discuss request to donate project to Open SSF
    • Where should this go within OpenSSF?
    • Tooling? Best Practices?
    • Part of automatic remediation

Recording at: https://youtu.be/KQv7CBm03QU

[varunsh-coder]

Adding link for 1-minute demo video for harden-runner
https://www.youtube.com/watch?v=DEHOOKRsg-8