Automated Techniques for Measuring Trustworthiness of Open Source Code and Communities
summary
Automated tools measure trustworthiness by running concrete checks and taking actions: Scorecard runs via docker or a GitHub Action using a GitHub token to flag issues like exposed secrets, workflow permission changes, unpinned dependencies and single-maintainer (bus factor 1) projects; results surface on pkg.go.dev and deps.dev. A companion GitHub App, Allstar, enforces or auto-fixes policies (branch protection, security.md) via an org-level YAML, files per-repo opt-outs, and raises issues when human fixes are required.
AI-written summary · about
chapters (10)
- 0:00Start
- 3:29What is Scorecard?
- 3:58Good practices
- 5:43Use cases?
- 6:11How to run Scorecard? Cu to run on individual projects
- 7:52pkg.go.dev integration
- 11:09What is Allstar?
- 12:02Allstar is a GitHub App
- 12:27Configure what you like
- 13:21Example Policies Branch Protection
related talks
25mHow do you trust your open source software?
16mFortify Your Code: Secure Your Supply Chain with Scorecard
27mHow Do You Trust Your Open Source Software?
50mHow Do You Trust Open Source Software?
31mScorecard at Scale: Old and New Possibilities for Lifting Security on All Repositories
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
01h 01mAutomating dependency selection with open-source tools at scale
32mVerifying the Validity of Crowd-Sourced Results in the Open Source Community: The Scorecard GitHub Action and Sigstore