[Feature]: Improvement of OpenSSF Scorecard Score

[harshitasao]

Requirement

Hi, I'm Harshita. I’m working with CNCF and the Google Open Source Security Team for the GSoC 2024 term. We are collaborating to enhance security practices across various CNCF projects. The goal is to improve security for all CNCF projects by both using OpenSSF Scorecards and implementing its security improvements.

Problem

As this project already has scorecard action, I'm here to increase the final score by going over each check. I've listed all of the checks where work needs to be done, in order of its criticality. I plan to submit each PR for each fix. Please let me know what you think and for which ones a PR is welcome that I will submit it ASAP.

Proposal

Current Score: 8.1

Scorecard report: https://scorecard.dev/viewer/?uri=github.com/jaegertracing/jaeger

Here's a few checks we can work on to improve the project's security posture:

• Token-Permissions: Score = 0

  • The issue here is that this workflow doesn’t have a top-level read-only permissions block like present in the other workflows. Scorecard is quite severe in this check: a single workflow without top-level permissions gets a 0/10 for the check.
  • PR: Pin GitHub Actions dependencies #5860

• Signed-Releases: Score = 8

  • SLSA provenance needs to be added, which can be done using this, increasing the overall score to 10.
  • Issue: [Feature]: Add SLSA provenance #5888

• Vulnerabilities: Score = 9

  • Affected package: github.com/aws/aws-sdk-go (https://osv.dev/vulnerability/GO-2022-0646) (Already fixed)
  • May need to add an osv-scanner.toml to mark some of these as not impacting/ignored.
  • Open vulnerabilities are easily exploited by attackers and should be fixed as soon as possible.

• Pinned-Dependencies: Score = 6

  • Some github actions and container image in Dockerfile are not pinned by hash, which is resulting in a low score. But pinning container images would introduce the risk of outdated images.
  • Pinning dependencies to a specific hash rather than allowing mutable versions or ranges of versions improves supply chain security.
  • PR: Pin GitHub Actions dependencies #5860

• Fuzzing: Score = 0

  • Integrating the project with OSS-Fuzz by following the instructions here. The most difficult one on the list, maintainers help, is highly appreciated.
  • See Comment

/cc @joycebrum @diogoteles08 @pnacht @nate-double-u

Open questions

No response

[yurishkuro]

@harshitasao thank you for assistance. I have no objection to these items, except for fuzzing.

[harshitasao]

Sure, I will make the PRs ASAP.