InsightSoftwareConsortium / InsightSoftwareConsortium/ITK
Improve ITK's OpenSSF scores
- Dominant language
- C++
- Stars
- 1.7k
- Forks
- 748
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 64
Description
### Description
As of Dec 16, 2024 ITK's OpenSSF scores are the following:
Holistic security practices
| Category | Group | Metric | Score |
|---------------|-----------|-----------|----------|
|  | 1 | CI-Tests | **10** |
|  | 1 | Fuzzing | **0** |
|  | 1 | SAST | **0** |
|  | 2 | CII-Best-Practices | **0** |
|  | 2 | Dependency-Update-Tool | **0** |
|  | 2 | License | **10** |
|  | 2 | Maintained | **10** |
|  | 2 | Security-Policy | **0** |
|  | 3 | Vulnerabilities | **10** |
Holistic security practices
| Category | Metric | Score |
|---------------|-----------|----------|
|  | Binary-Artifacts | **10** |
|  | Branch-Protection | **8** |
|  | Code-Review | **10** |
|  | Contributors | **10** |
|  | Dangerous-Workflow | **-1** |
Build risk assessment
| Category | Metric | Score |
|---------------|-----------|----------|
|  | Packaging | **-1** |
|  | Pinned-Dependencies | **0** |
|  | Signed-Releases | **0** |
|  | Token-Permissions | **-1** |
| Metric | Score |
|-----------|----------|
| **Total Score** | **5.3** |
So the following aspects need improvement:
- [ ] Fuzzing
- [ ] SAST
- [ ] CII-Best-Practices
- [ ] Dependency-Update-Tool
- [ ] Security-Policy
- [ ] Branch-Protection
- [ ] Dangerous-Workflow
- [ ] Packaging
- [ ] Pinned-Dependencies
- [x] Signed-Releases
- [ ] Token-Permissions
Check current scores at https://scorecard.dev/viewer/
### Impact analysis
Scoring high on each of the above aspects would improve the security of the ITK code and/or the infrastructure it uses and provide some safety guarantee to consumers.
### Expected behavior
ITK scrores high in OpenSSF scores.
### Actual behavior
ITK scrores in OpenSSF have room for improvement.
### Versions
`master`
### Environment
N/A
### Additional Information
Related to PR #5078.
More information: https://github.com/ossf/scorecard
Some items may not apply to ITK, and thus may need to be bypassed in the evaluation, and some others are maybe not being processed correctly (e.g. signed releases).
Contributor guide
Assessment
This issue has not been assessed yet.