Improvement of OpenSSF Scorecard Score

[harshitasao]

Hi, I'm Harshita. I’m working with CNCF and the Google Open Source Security Team for the GSoC 2024 term. We are collaborating to enhance security practices across various CNCF projects. The goal is to improve security for all CNCF projects by both using OpenSSF Scorecards and implementing its security improvements.

As this project already has scorecard action, I'm here to increase the final score by going over each check. I've listed all of the checks where work needs to be done, in order of its criticality. I plan to submit each PR for each fix. Please let me know what you think and for which ones a PR is welcome that I will submit it ASAP.

Current Score: 3.8

Scorecard report: https://scorecard.dev/viewer/?uri=github.com/notaryproject/notary

Here's a few checks we can work on to improve the project's security posture:

• Maintained: Score = 0

  • There is no remediation work needed from projects with a low score; this check simply provides insight into the project activity and maintenance commitment. External users should determine whether the software is the type that would not normally need active maintenance.

• Signed-Releases: Score = 0

  • The releases need to be signed; we can use cosign using github actions for that, and it will increase the score to 8. Additionally, SLSA provenance also needs to be added, which can be done using this, increasing the overall score to 10.

• Vulnerabilities: Score = 0

  • After running the osv scanner locally, a significant amount of vulnerabilities were found that need to be fixed.
  • PR: vulnerability fix #1706

• SAST: Score = 0

  • Running the CodeQL checks in the CI/CD by following the instructions here.

• Fuzzing: Score = 0

  • Integrating the project with OSS-Fuzz by following the instructions here. The most difficult one on the list, maintainers help, is highly appreciated. For example, helping in identifying the components where fuzz testing will be added.

• Pinned-Dependencies: Score = 3

  • Container images, pip commands and go commands are not pinned by hash, which results in a low score. But pinning these would introduce the risk of running outdated versions.

• CII-Best Practices: Score = 0

  • This check determines whether the project has earned an OpenSSF (formerly CII) Best Practices Badge at the passing, silver, or gold level. The OpenSSF Best Practices badge indicates whether or not that the project uses a set of security-focused best development practices for open source software.
  • To remediate the check, sign up for the OpenSSF Best Practices program.
  • NOTE: This can only be done by mainatiner of the project.

/cc @joycebrum @diogoteles08 @pnacht @nate-double-u