InsightSoftwareConsortium / InsightSoftwareConsortium/ITK

Improve ITK's OpenSSF scores

Open
#5,084 1 comment 1 reaction 2 assignees Claimed by @jjomier View on GitHub
type:Infrastructure
Dominant language
C++
Stars
1.7k
Forks
748
Avg merge
1d 1h
Merged PRs (30d)
64

Description

### Description

As of Dec 16, 2024 ITK's OpenSSF scores are the following:

Holistic security practices

| Category | Group | Metric | Score |
|---------------|-----------|-----------|----------|
| ![#f8ed62](https://via.placeholder.com/15/f8ed62/000000?text=+) | 1 | CI-Tests | **10** |
| ![#ffa500](https://via.placeholder.com/15/ffa500/000000?text=+) | 1 | Fuzzing | **0** |
| ![#ffa500](https://via.placeholder.com/15/ffa500/000000?text=+) | 1 | SAST | **0** |
| ![#f8ed62](https://via.placeholder.com/15/f8ed62/000000?text=+) | 2 | CII-Best-Practices | **0** |
| ![#ff0000](https://via.placeholder.com/15/ff0000/000000?text=+) | 2 | Dependency-Update-Tool | **0** |
| ![#f8ed62](https://via.placeholder.com/15/f8ed62/000000?text=+) | 2 | License | **10** |
| ![#ff0000](https://via.placeholder.com/15/ff0000/000000?text=+) | 2 | Maintained | **10** |
| ![#ffa500](https://via.placeholder.com/15/ffa500/000000?text=+) | 2 | Security-Policy | **0** |
| ![#ff0000](https://via.placeholder.com/15/ff0000/000000?text=+) | 3 | Vulnerabilities | **10** |

Holistic security practices

| Category | Metric | Score |
|---------------|-----------|----------|
| ![#ff0000](https://via.placeholder.com/15/ff0000/000000?text=+) | Binary-Artifacts | **10** |
| ![#ff0000](https://via.placeholder.com/15/ff0000/000000?text=+) | Branch-Protection | **8** |
| ![#ff0000](https://via.placeholder.com/15/ff0000/000000?text=+) | Code-Review | **10** |
| ![#f8ed62](https://via.placeholder.com/15/f8ed62/000000?text=+) | Contributors | **10** |
| ![#cc1100](https://via.placeholder.com/15/cc1100/000000?text=+) | Dangerous-Workflow | **-1** |

Build risk assessment

| Category | Metric | Score |
|---------------|-----------|----------|
| ![#ffa500](https://via.placeholder.com/15/ffa500/000000?text=+) | Packaging | **-1** |
| ![#ffa500](https://via.placeholder.com/15/ffa500/000000?text=+) | Pinned-Dependencies | **0** |
| ![#ff0000](https://via.placeholder.com/15/ff0000/000000?text=+) | Signed-Releases | **0** |
| ![#ff0000](https://via.placeholder.com/15/ff0000/000000?text=+) | Token-Permissions | **-1** |

| Metric | Score |
|-----------|----------|
| **Total Score** | **5.3** |

So the following aspects need improvement:

- [ ] Fuzzing
- [ ] SAST
- [ ] CII-Best-Practices
- [ ] Dependency-Update-Tool
- [ ] Security-Policy
- [ ] Branch-Protection
- [ ] Dangerous-Workflow
- [ ] Packaging
- [ ] Pinned-Dependencies
- [x] Signed-Releases
- [ ] Token-Permissions

Check current scores at https://scorecard.dev/viewer/

### Impact analysis

Scoring high on each of the above aspects would improve the security of the ITK code and/or the infrastructure it uses and provide some safety guarantee to consumers.

### Expected behavior

ITK scrores high in OpenSSF scores.

### Actual behavior

ITK scrores in OpenSSF have room for improvement.

### Versions

`master`

### Environment

N/A

### Additional Information

Related to PR #5078.

More information: https://github.com/ossf/scorecard

Some items may not apply to ITK, and thus may need to be bypassed in the evaluation, and some others are maybe not being processed correctly (e.g. signed releases).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.