Securing Git repositories with gittuf

Well I think the entire point of OpenSSF is to shove compliance to some sort of rules down the throats of developers.

I've actually tried to implement their scorecard thing for my project "typedload".

For example, you need to pin dependencies, because a new version might introduce vulnerabilities… but you also need to update the pin all the time for old security vulnerabilities. Also, if you never read the code of the dependencies, what is the point of pinning to a specific version? Nobody has vetted it any more than a newer version (I always use latest mypy in the CI).

They want me to have a "dependency update tool"… the project only depends on python, and certainly doesn't vendor it.

Or they want me to have branch protection and code revisions. Cool… except who should review my code? Most other contributors just changed a few lines here and there. The suggestion to fix this is "find more people".

I work for a security company and we have fewer requirements than that :D

Anyway, this thing being sponsored by OpenSSF makes me think their goal is to enforce these rules onto open source, so that eventually proprietary stuff will only run the secure™ (is on github, runs their scorecard) open source software and will automatically be compliant without extra vetting of the dependencies.

The hilarious thing is that you can write an "rm -rf /" in your code and still be 100% compliant with everything. Because the idea that you can evaluate security of a project just basing on some abstract rules, without actually reading the code is wrong to begin with.