Implementing OSSF Scorecard

[UlisesGascon]

Some time ago, we implemented the monitoring and review of the OSSF scorecard in the Node.js org, and it significantly contributed to the improvement of many repositories. I believe adopting a similar approach for Express would be highly beneficial. We've developed tools, such as the OpenSSF Scorecard Monitor and OpenSSF Scorecard Visualizer, along with processes that make handling the evolution of scoring straightforward. Despite initial appearances, the process is quite simple.

Context

The goal of Scorecards is to auto-generate a “security score” for open source projects to help users as they decide the trust, risk, and security posture for their use case. This data can also be used to augment any decision making in an automated fashion when new open source dependencies are introduced inside projects or at organizations. For example, organizations may decide that any new dependency with low scores has to go through additional evaluation. These checks could help mitigate malicious dependencies from getting deployed to production systems like we’ve seen recently with malicious NPM packages.
source: openssf Blog

Resources

• OpenSSF Scorecard
• You should use the OpenSSF Scorecard
• OpenSSF Scorecard API
• Security Scorecards for Open Source Projects

Next Steps:

• Define when/how to review the scoring as a team. For example, in Node.js, we conduct this review in every Security WG Meeting. Watch example (minute 04:00 to 10:00) and the dashboard
• Add the Scorecard pipelines to the projects. View example
• Improve the scoring by patching the bugs. See example

I'm enthusiastic about leading these changes in the repos. While we may not be familiar with the OSSF Scorecard, we already have scores for most of our projects. Here is a simple dashboard that I auto-generated. The OSSF team is already tracking our projects using a CRON job, but we can easily enrich them and make some simple patches to increase the scoring.

Most of these changes won't require significant alterations and can be performed in isolated PRs, making them easy to review. If we're in agreement, I can start with the Express project to showcase the process. 👍

[dougwilson]

If we're in agreement, I can start with the Express project to showcase the process. 👍

Go for it. And if it makes it amy easier you are always welcome to start with any of the smaller, simplier middleware repos.

[inigomarquinez]

Good afternoon!

I've had a chat with @UlisesGascon to tell him that I am interested in contributing to this initiative, as the OpenSSF Scorecard is something that I like and that I have also helped to implement in the Open Source community of the company where I work.

[UlisesGascon]

Yeah! Welcome aboard @inigomarquinez 🎉

[carpasse]

Good Morning!

I've also had a chat with @UlisesGascon and I am interested in contributing to this initiative too.

[UlisesGascon]

As discussed with @inigomarquinez, he will champion this initiative 🎉

[inigomarquinez]

Thanks for the opportunity @UlisesGascon !

[inigomarquinez]

We can say that the implementation of the scorecard has been completed in most of the organisations' repositories expressjs, pillarjs and jshttp. The implementation has been the same in all cases, adding a github action in each repository called scorecard.yml (see example here). This action is executed both with each push to master and weekly via a cronjob.

Some repositories of the 3 organisations have been discarded and the scorecard has not been integrated in them for several reasons: they have been deprecated, they have not been updated for a long time (more than 10 years), they are not applicable (documentation repositories) or they have a very low level of downloads and it is more than likely that in the near future they will be archived.

After finalising the integration, the next step is to analyse the scores in the individual repositories and take suggested actions to improve these scores.

@UlisesGascon , should we mark this issue as closed?

[UlisesGascon]

Thanks for all the hard work @inigomarquinez and @carpasse!

@UlisesGascon , should we mark this issue as closed?

I prefer to keep it open until the PRs related to the Express repo are merged, so we can have a clear policy on how to patch the other repositories.

[wesleytodd]

Looks like some of them are broken. maybe @carpasse or @inigomarquinez, do you have time to look into it?

https://github.com/jshttp/http-errors/actions/runs/11797478580/job/32861554162
https://github.com/pillarjs/router/actions/runs/11802755050

[carpasse]

@wesleytodd I will try to take a look at the broken ones this week.

[carpasse]

I've run a bash script to identify repositories with a failed Scorecard Workflow Action. Below is the list of affected repositories organized by organization.

I plan to address them over the next month, but if anyone can take on any of these, please mark it in the checklist below to avoid duplication of effort.

Organization: expressjs

• expressjs/errorhandler chore: upgrade scorecard workflow pinned action versions errorhandler#30
• expressjs/cors chore: upgrade scorecard workflow pinned action versions cors#341
• expressjs/session chore: upgrade scorecard workflow pinned action versions session#1008
• expressjs/multer chore: upgrade scorecard workflow pinned action versions multer#1290
• expressjs/serve-index chore: upgrade scorecard workflow pinned action versions serve-index#112
• expressjs/cookie-session chore: upgrade scorecard workflow pinned action versions cookie-session#184
• expressjs/method-override chore: upgrade scorecard workflow pinned action versions method-override#18
• expressjs/serve-favicon chore: upgrade scorecard workflow pinned action versions serve-favicon#50

Organization: pillarjs

• pillarjs/router chore: upgrade scorecard workflow pinned action versions pillarjs/router#150

Organization: jshttp

• jshttp/mime-db chore: upgrade scorecard workflow pinned action versions jshttp/mime-db#354
• jshttp/http-errors chore: upgrade scorecard workflow pinned action versions jshttp/http-errors#113
• jshttp/content-disposition chore: upgrade scorecard workflow pinned action versions jshttp/content-disposition#65
• jshttp/accepts chore: upgrade scorecard workflow pinned action versions jshttp/accepts#40
• jshttp/mime-types chore: upgrade scorecard workflow pinned action versions jshttp/mime-types#130
• jshttp/basic-auth chore: upgrade scorecard workflow pinned action versions jshttp/basic-auth#64
• jshttp/etag chore: upgrade scorecard workflow pinned action versions jshttp/etag#34

Feel free to tackle any of these. Just check the box to indicate you're working on it. Thanks!

[carpasse]

@wesleytodd , could you please review the PR for HTTP Errors and merged if you are ok with it? I looked into the issue with @UlisesGascon , and it’s not failing due to a problem with the code itself but because it can’t obtain the certificate needed to publish the results (link). This issue seems to be outside the control of the GitHub Actions. I was hoping that updating the scorecard action dependency might "fix" it.

[carpasse]

@expressjs/express-tc As @jonkoops mentioned in this comment, we should decide on which tool to use—Dependabot or Renovate—so that we don’t have to perform these version updates manually.