Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Feature Request] Add OpenSSF Scorecard information #1349

Open
heryxpc opened this issue Aug 28, 2024 · 0 comments
Open

[Feature Request] Add OpenSSF Scorecard information #1349

heryxpc opened this issue Aug 28, 2024 · 0 comments
Labels
data-addition Describes adding new data to the graph GitHub Related to GitHub intel module

Comments

@heryxpc
Copy link
Contributor

heryxpc commented Aug 28, 2024

Title: Ingest OpenSSF scorecard information

Description:
Create a new node OpenSSFScorecard with Github's scorecard checks for every project ingested.
An OpenSSF scorecard is a serious of checks that can be useful to surface the security posture of a project.
See for example https://scorecard.dev/viewer/?uri=github.com/lyft/cartography
Checks can be used as an overall score or in an individual form, for example to determine if the project is actively maintained (which could reflect if cadence of security fixes).

The information can be queried using a public API, for example https://api.securityscorecards.dev/projects/github.com/lyft/cartography

This could be a separate intel module or a submodule from https://github.com/lyft/cartography/blob/master/cartography/intel/github

[optional Relevant Links:]
https://openssf.org/projects/scorecard/
https://openssf.org/blog/2024/04/17/beyond-scores-with-openssf-scorecard-granular-structured-results-for-custom-policy-enforcement/
https://api.securityscorecards.dev/

@chandanchowdhury chandanchowdhury added GitHub Related to GitHub intel module data-addition Describes adding new data to the graph labels Aug 28, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
data-addition Describes adding new data to the graph GitHub Related to GitHub intel module
Projects
None yet
Development

No branches or pull requests

2 participants