microsoft / microsoft/ebpf-for-windows

Scorecards job failing for most merged PRs

Open
#2,936 1 comment 0 reactions 0 assignees View on GitHub
bug help wanted triaged
Dominant language
C
Stars
3.6k
Forks
311
Avg merge
6d 10h
Merged PRs (30d)
21

Description

### Describe the bug

Example failure at the bottom:
https://github.com/microsoft/ebpf-for-windows/actions/runs/6383992434/job/17325721329

This looks like some private endpoint used for signing the results is no longer available:
```
Generating ephemeral keys...
Retrieving signed certificate...
2023/10/02 18:26:05 error signing scorecard results: getting key from Fulcio: retrieving cert: client: Post "https://fulcio.sigstore.dev/api/v1/signingCert": dial tcp 54.185.253.63:443: connect: connection refused
```

### Steps taken to reproduce bug

submit a PR

### Expected behavior

our merged PRs have the green checkmar signifying all jobs passed, including this optional one.
Otherwise, we might as well remove this.

### Actual outcome

scorecards job has been failing for a while

Contributor guide

Open the contributing guide

Research direction

Start with the linked GitHub Actions run and inspect the Scorecards job configuration and its signing step. Check whether the Fulcio endpoint and signing setup used by the job are still available; done means the optional Scorecards check passes for merged PRs, or the job is removed if it cannot be restored.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions
Domain
ci-cd, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.