Verifying the Validity of Crowd-Sourced Results in the Open Source Community: The Scorecard GitHub Action and Sigstore
summary
The Scorecard GitHub Action produces crowd-sourced security results for ~1,000,000 repositories per week and signs each result with Sigstore tooling: cosign, fulcio (10-minute x509 certificates) and the rekor transparency log. The server verifies a SHA256 content hash, checks rekor inclusion proofs and certificate timestamps, extracts the GitHub workflow URI and workflow SHA, and enforces minimal token permissions plus an allowlist of job steps before accepting a published score.
AI-written summary · about
chapters (7)
- 0:00Verifying trust in open source
- 3:09Trust in open source security
- 8:55Scorecard with remote attestations
- 13:51Demo: verifying scorecard results
- 20:54Validating scorecard workflows
- 26:55Summary of crowdsourced validation
- 29:27Q&A on multi-repo scaling
related talks
31mScorecard at Scale: Old and New Possibilities for Lifting Security on All Repositories
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
27mHow Do You Trust Your Open Source Software?
16mFortify Your Code: Secure Your Supply Chain with Scorecard
25mHow do you trust your open source software?
36mEstimating Security Risk Through Repository Mining
19mAutomated Techniques for Measuring Trustworthiness of Open Source Code and Communities
50mHow Do You Trust Open Source Software?