Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

📖 Add new frequently asked question to FAQ #2923

Merged
merged 4 commits into from
Apr 30, 2023
Merged

📖 Add new frequently asked question to FAQ #2923

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d3ca64c
feat: add trust dependabot question to FAQ
joycebrum Apr 26, 2023
bb81334
fix: update name to be more specific
joycebrum Apr 26, 2023
b0f9766
Update faq.md
joycebrum Apr 26, 2023
f4637f0
Fix: keep FAQ in ascending order
joycebrum Apr 26, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions docs/faq.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ This page answers frequently asked questions about Scorecard, including its purp
## Check-Specific Questions
- [Binary-Artifacts: Can I allowlist testing artifacts?](#binary-artifacts-can-i-allowlist-testing-artifacts)
- [Code-Review: Can it ignore bot commits?](#code-review-can-it-ignore-bot-commits)
- [Dependency-Update-Tool: Why should I trust recommended updates are safe?](#dependency-Update-Tool-why-should-i-trust-recommended-updates-are-safe)
- [Fuzzing: Does Scorecard accept custom fuzzers?](#fuzzing-does-scorecard-accept-custom-fuzzers)
- [Pinned-Dependencies: Will Scorecard detect unpinned dependencies in tests with Dockerfiles?](#pinned-dependencies-will-scorecard-detect-unpinned-dependencies-in-tests-with-dockerfiles)
- [Pinned-Dependencies: Can I use version pinning instead of hash pinning?](#pinned-dependencies-can-i-use-version-pinning-instead-of-hash-pinning)
Expand Down Expand Up @@ -56,6 +57,14 @@ This is quite a complex question. Right now, there is no way to do that. Here ar

However, this is being discussed by the Scorecard Team ([#2302](https://github.com/ossf/scorecard/issues/2302)).

### Dependency-Update-Tool: Why should I trust recommended updates are safe?

Both dependabot and renovatebot won't update your dependencies immediately. They have some precautions to make sure a release is reasonable / won't break your build (see [dependabot compatibility documentation](https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates#about-compatibility-scores)).

You can either configure the tools to only update your dependencies once a week or once a month. This way, if a malicious version is released, it's very likely that it'll be reported and removed before it even gets suggested to you. Besides, there's also the benefit that it gives you the chance to validate the new release before merging if you want to.

Another configuration possibility that would limit even more the release updates only to trusted releases is enabling to only perform Security Updates, which means you only be notified about releases that fixes a previous vulnerability you might be exposed to.

### Fuzzing: Does Scorecard accept custom fuzzers?

Currently only for projects written in Go.
Expand All @@ -80,3 +89,4 @@ Currently, the main benefit of [signed releases](checks.md#signed-releases) is t
However, there are already moves to make it even more relevant. For example, the OpenSSF is working on [implementing signature verification for NPM packages](https://github.blog/2022-08-08-new-request-for-comments-on-improving-npm-security-with-sigstore-is-now-open/) which would allow a consumer to automatically verify if the package they are downloading was generated through a reliable builder and if it is correctly signed.

Signing releases already has some relevance and it will soon offer even more security benefits for both consumers and maintainers.