openssf scorecard: Project has not signed or included provenance with any releases (do cosign releases, and source signed tags)
- Dominant language
- TypeScript
- Stars
- 102
- Forks
- 25
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 22
Description
- [x] mac binary signed
- [x] windows binary signed
- [ ] source signed (tags) (like verified git commits) (1 day)
- [ ] Cosign sigstore signed (now quite standard way of signing releases that ossf scorecard checks)
- [ ] Option 1: Post-Release GitHub Action (1week)
[scorecard learn more link](https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#signed-releases)
```
Warn: release artifact v0.1.0-alpha not signed: https://api.github.com/repos/Azure/aks-desktop/releases/263657297
Warn: release artifact v0.1.0-alpha does not have provenance: https://api.github.com/repos/Azure/aks-desktop/releases/263657297
```
- [ ] .deb binary signed (do not do for now)
Contributor guide
Research direction
Start with the OpenSSF Scorecard signed-releases guidance linked in the issue and inspect the post-release GitHub Action option. The source tags should be signed, and releases should include Cosign Sigstore provenance; leave .deb signing out for now. Verify the result against the Scorecard warnings for the release artifacts.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- git, github-actions
- Domain
- ci-cd, release, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100