microsoft / microsoft/ebpf-for-windows
Scorecards job failing for most merged PRs
- Dominant language
- C
- Stars
- 3.6k
- Forks
- 311
- Avg merge
- 6d 10h
- Merged PRs (30d)
- 21
Description
### Describe the bug
Example failure at the bottom:
https://github.com/microsoft/ebpf-for-windows/actions/runs/6383992434/job/17325721329
This looks like some private endpoint used for signing the results is no longer available:
```
Generating ephemeral keys...
Retrieving signed certificate...
2023/10/02 18:26:05 error signing scorecard results: getting key from Fulcio: retrieving cert: client: Post "https://fulcio.sigstore.dev/api/v1/signingCert": dial tcp 54.185.253.63:443: connect: connection refused
```
### Steps taken to reproduce bug
submit a PR
### Expected behavior
our merged PRs have the green checkmar signifying all jobs passed, including this optional one.
Otherwise, we might as well remove this.
### Actual outcome
scorecards job has been failing for a while
Contributor guide
Research direction
Start with the linked GitHub Actions run and inspect the Scorecards job configuration and its signing step. Check whether the Fulcio endpoint and signing setup used by the job are still available; done means the optional Scorecards check passes for merged PRs, or the job is removed if it cannot be restored.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions
- Domain
- ci-cd, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100