Improve openssf scorecard (currently 5.2) #1107

Activity

1. jalseth commented on May 5, 2025

   

   jalseth

   on May 5, 2025

   Member

   More actions

   Hi, thanks for raising this. I am open to the idea, but a quick skim of the report shows multiple findings that are either false, or misleading. For example:

   • It gives a score of 0 for GITHUB_TOKEN permissions, despite the only the release workflow having any write permissions
   • It gives a score of 0 for fuzzing, but fuzzing doesn't make sense for a glue-code project like conftest
   • It lists conftest as vulnerable to many things it is not vulnerable to, such as GHSA-6fpp-rgj9-8rwc which is a Java vuln and conftest does not have or use any Java code
   • It gives a score of 0 just for not having the OpenSSF scorecard in the project

   With all of these inaccuracies, I don't want to add this to conftest which may deter people from using the project because they think there are glaring security issues, when there are not. If you want to contribute to some of the areas where the project is indeed lacking (like release signing) that would be welcome.

   👍React with 👍2Reacted by David Michael and Ville Vesilehto