Package: hoppr-openssf-scorecard
Hoppr OpenSSF Scorecard PluginPlugin forHopprto populate component metadata in aCycloneDXSoftware Bill of Materials (SBOM) with data fromOpenSSF Scorecard.How to use this pluginGet a Libraries.io API keyIn order to use this plugin, an API key fromLibraries.iois required.Log in toLibraries.iousing a GitHub, GitLab, or BitBucket accountRetrieve the API key fromaccount settingsOnce you have this API key, you can provide it to the plugin in one of the following ways:Set theLIBRARIES_API_KEYenvironment variable in the shell before running HopprexportLIBRARIES_API_KEY="<your key here>"Create aHoppr credentials filewith an entry forhttps://libraries.io/apiand an environment variable of your choosing that holds the value of the API key---schemaVersion:v1kind:Credentialscredential_required_services:-url:https://libraries.io/apiuser:""pass_env:API_KEY_ENV_VARCreate a transfer fileAHoppr transfer filedefines the stages to be run and which plugins will be run in those stages.Create a transfer file that defines a stage with this plugin (identified byhoppr_openssf_scorecard.plugin) specified. For example:---schemaVersion:v1kind:Transferstages:ScorecardData:plugins:-name:hoppr_openssf_scorecard.pluginBundle:plugins:-name:hoppr.core_plugins.bundle_tarconfig:tarfile_name:tarfile.tar.gzmax_processes:10Run HopprThat's everything! Runhopctl bundleas normal and the SBOM with Scorecard data will be located in the specified bundle file.How does it work?Get the source control repository URLVarious API endpoints are leveraged in an attempt to retrieve a component's source control repository URL in order to request a Scorecard report.First, a REST API or well-known metadata URL for the package manager specific to the PURL type of the component is tried.PURL TypeURL Endpoint(s)debhttps://sources.debian.org/apifor Debian,https://api.launchpad.net/1.0for Ubuntugemhttps://rubygems.org/api/v1gitSearches bothhttps://api.github.comandhttps://gitlab.com/api/v4golangFirsthttps://proxy.golang.org, thenhttps://libraries.io/api/Goif not foundhelmhttps://artifacthub.io/api/v1/packages/helmmavenFirst,https://search.maven.org/remotecontent, thenhttps://libraries.io/api/Mavenif not foundnpmhttps://registry.npmjs.compypihttps://pypi.org/pypirpmRepository metadata from eitherrpmrepositories defined in the manifest file, or sensible defaults.These are the defaults for RPM components if not provided.DistributionMetadata URLRed Hat 7http://mirror.centos.org/centos/7/os/x86_64http://mirror.centos.org/centos/7/extras/x86_64Red Hat/Rocky Linux 8https://dl.rockylinux.org/pub/rocky/8/AppStream/x86_64/oshttps://dl.rockylinux.org/pub/rocky/8/BaseOS/x86_64/oshttps://dl.rockylinux.org/pub/rocky/8/PowerTools/x86_64/oshttps://dl.rockylinux.org/pub/rocky/8/extras/x86_64/osRed Hat/Rocky Linux 9https://dl.rockylinux.org/pub/rocky/9/AppStream/x86_64/oshttps://dl.rockylinux.org/pub/rocky/9/BaseOS/x86_64/oshttps://dl.rockylinux.org/pub/rocky/9/CRB/x86_64/oshttps://dl.rockylinux.org/pub/rocky/9/extras/x86_64/osFedorahttps://dl.fedoraproject.org/pub/fedora/linux/releases/<Fedora release>/Everything/x86_64/osIf a source control repository isn't found this way, the next attempt is to searchLibraries.ioand try to narrow down and intuit the correct repo URL from the results.Finally, as a last-ditch effort, the GitHub API is queried in a similar fashion. If no repository URL is found by this point, the component is skipped and the plugin will move on to the next one.If a repository URL was found during any of these passes, it gets added to the SBOM compoment'sexternalReferencesas a URL with a type ofvcs.Request the report data from Scorecard APIFor components that have avcsrepository URL (whether identified as outlined in the previous section or explicitly defined in the SBOM), a request is made to the OpenSSF Scorecard API using that project URL.The response data is then used to populate the SBOM according to the taxonomy outlined below.SBOM property taxonomyProperties generated by this plugin consist of anameprefixed withhoppr:scorecardand avaluecorresponding to the associated Scorecard field.NameDescriptionhoppr:scorecard:dateDate of the Scorecard reporthoppr:scorecard:metadataMetadata for the Scorecard reporthoppr:scorecard:repo:commitCommit ref/SHA the report was run onhoppr:scorecard:repo:nameName of the repositoryhoppr:scorecard:scoreAggregate score for all checkshoppr:scorecard:scorecard:commitCommit ref/SHA of Scorecard used to generate the reporthoppr:scorecard:scorecard:versionVersion of Scorecard used to generate the reporthoppr:scorecard:check:Binary-ArtifactsScore for theBinary-Artifactscheckhoppr:scorecard:check:Branch-ProtectionScore for theBranch-Protectioncheckhoppr:scorecard:check:CI-TestsScore for theCI-Testscheckhoppr:scorecard:check:CII-Best-PracticesScore for theCII-Best-Practicescheckhoppr:scorecard:check:Code-ReviewScore for theCode-Reviewcheckhoppr:scorecard:check:ContributorsScore for theContributorscheckhoppr:scorecard:check:Dangerous-WorkflowScore for theDangerous-Workflowcheckhoppr:scorecard:check:Dependency-Update-ToolScore for theDependency-Update-Toolcheckhoppr:scorecard:check:FuzzingScore for theFuzzingcheckhoppr:scorecard:check:LicenseScore for theLicensecheckhoppr:scorecard:check:MaintainedScore for theMaintainedcheckhoppr:scorecard:check:PackagingScore for thePackagingcheckhoppr:scorecard:check:Pinned-DependenciesScore for thePinned-Dependenciescheckhoppr:scorecard:check:SASTScore for theSASTcheckhoppr:scorecard:check:Security-PolicyScore for theSecurity-Policycheckhoppr:scorecard:check:Signed-ReleasesScore for theSigned-Releasescheckhoppr:scorecard:check:Token-PermissionsScore for theToken-Permissionscheckhoppr:scorecard:check:VulnerabilitiesScore for theVulnerabilitiescheckhoppr:scorecard:check:WebhooksScore for theWebhookscheckFor descriptions of all the checks performed by Scorecard, seethis table.