Open Source Summit North America 2023

The Scorecard GitHub Action is a tool that helps ensure the security of OSS projects and helps users determine the safety of their dependencies. The OSSF Scorecard is an automated tool that assesses many critical heuristics ("checks") associated with software security and assigns each check a score of 0-10. The results of the Scorecard action are automatically run on every repository when code is merged to the main branch and are stored in the Scorecard API, serving as the source of crowd-sourced results. The results crowd-sourced from the Action run need to be trustworthy. But the Action runs in a GitHub workflow controlled by the project maintainer who installed the Scorecard Action. This talk will go into the details of how we added integrity protection to the results. We will provide a comprehensive overview of how the Scorecard GitHub action uses Sigstore (cosign, fulcio, and rekor) to build this remote attestation mechanism. Using diagrams and code examples, we will uncover the workflow for validating rekor results and provide practical guidance for attendees. This interactive element of the talk will help the community understand the mechanics behind verifying the authenticity and integrity of crowd-sourced results.