Improvement of OpenSSF Scorecard Score

[harshitasao]

Is your feature request related to a problem? Please describe.

Hi, I'm Harshita. I’m working with CNCF and the Google Open Source Security Team for the GSoC 2024 term. We are collaborating to enhance security practices across various CNCF projects. The goal is to improve security for all CNCF projects by both using OpenSSF Scorecards and implementing its security improvements.

Describe the solution you'd like

As this project already has scorecard action, I'm here to increase the final score by going over each check. I've listed all of the checks where work needs to be done, in order of its criticality. I plan to submit each PR for each fix. Please let me know what you think and for which ones a PR is welcome that I will submit it ASAP.

Current Score: 8.2

Scorecard report: https://scorecard.dev/viewer/?uri=github.com/fluent/fluentd

Here's a few checks we can work on to improve the project's security posture:

• Fuzzing: Score = 0

  • Integrating the project with OSS-Fuzz by following the instructions here. The most difficult one on the list, maintainers help, is highly appreciated. For example, helping in identifying the components where fuzz testing will be added.
  • Issue: Add Fuzz-testing #4614

• Pinned-Dependencies: Score = 2

  • Some github actions are not pinned by hash, which results in a low score.
  • Pinning dependencies to a specific hash rather than allowing mutable versions or ranges of versions improves supply chain security.
  • PR: fix: fixed the pinned dependencies issue #4602

• CI-Tests: Score = 6
  - This check tries to determine if the project runs tests before pull requests are merged.
  - To remediate this check, 1. Check-in scripts that run all the tests in the repository. 2. Integrate those scripts with a CI/CD platform that runs it on every pull request.

Describe alternatives you've considered

N/A

Additional context

/cc @joycebrum @diogoteles08 @pnacht @nate-double-u

[daipom]

Thanks!
I am daipom, one of Fluentd maintainers.
I am happy to cooperate with this task!

• Fuzzing
  • Please feel free to consult us if there’s anything you need.

  • For example, helping in identifying the components where fuzz testing will be added.

    • Some input plugins receive data online, so it may be a good idea to add a fuzz test for them first.
      • https://docs.fluentd.org/input/forward
      • https://docs.fluentd.org/input/udp
      • https://docs.fluentd.org/input/tcp
      • https://docs.fluentd.org/input/http
      • https://docs.fluentd.org/input/syslog
• Pinned-Dependencies
  • I see! A fix like fix: fixed the pinned dependencies issue #4602 would be welcome!
• CI-Tests
  • CI is supposed to be executed every time. I'm not sure why this score is so low,

  • 10 out of 15 merged PRs checked by a CI test

    • Why are some not counted?
    • Merged before testing was complete? Or merged with a failed test?
    • Actually, some tests are unstable and fail sometimes. They should be improved.

[kenhys]

As pinned-dependency was fixed, so it gained score 8.7.

[kenhys]

By the way, it might be better to split the Fuzzing and CI-Tests issue because it becomes long standing topics.

Crossover topics in one issue is not desirable, IMHO.

[kenhys]

@harshitasao could you create a separated issue for Fuzzing and CI-Tests respectively?
(I'll appreciate you called attention these issues to us)

I'll close this issue not to mixin these topics. (should focus on one topic in every issue)