Improvement of OpenSSF Scorecard Score

[harshitasao]

Hi, I'm Harshita. I’m working with CNCF and the Google Open Source Security Team for the GSoC 2024 term. We are collaborating to enhance security practices across various CNCF projects. The goal is to improve security for all CNCF projects by both using OpenSSF Scorecards and implementing its security improvements.

After the opening of the scorecard action addition PR, I'm here to increase the final score by going over each check. I've listed all of the checks where work needs to be done, in order of its criticality. I plan to submit each PR for each fix. Please let me know what you think and for which ones a PR is welcome that I will submit it ASAP.

Current Score: 7.9

Scorecard report: https://scorecard.dev/viewer/?uri=github.com/vitessio/vitess

Here's a few checks we can work on to improve the project's security posture [ in order of its criticality ]:

• Signed-Releases: Score = 0

  • The releases need to be signed; we can use cosign using github actions for that, and it will increase the score to 8. Additionally, SLSA provenance also needs to be added, which can be done using this, increasing the overall score to 10.

• Binary-Artifacts: Score = 8

  • The project contains two binaries: https://github.com/vitessio/vitess/blob/main/go/vt/vttablet/endtoend/udf.so https://github.com/vitessio/vitess/blob/main/test/bin/rippled
  • Problems with generated executable (binary) artifacts
  • Binaries allowed by Scorecard
  • To solve this we can either remove the generated executable artifacts from the repository or build from source.

• Vulnerabilities: Score = 9

  • Affected package: github.com/aws/aws-sdk-go (https://osv.dev/vulnerability/GO-2022-0646)
  • PR: vulnerability fix #16613

• Pinned-Dependencies: Score = 0

  • Github actions, go and pip commands are not pinned by hash, which is resulting in a low score. But pinning go and pip would introduce the risk of running outdated versions.
  • Pinning dependencies to a specific hash rather than allowing mutable versions or ranges of versions improves supply chain security.
  • PR: fix: fixed the pinned-dependencies #16612

/cc @joycebrum @diogoteles08 @pnacht @nate-double-u

[mattlord]

Thanks, @harshitasao ! ❤️