Skip to content

Feature: Improve Pinned-Dependencies score calculation #2582

@gabibguti

Description

@gabibguti

Is your feature request related to a problem? Please describe.

I'm frustrated when I have multiple Pinned-Dependencies warnings, I fix multiple warnings and my score does not change for that check.

After some code analysis I got to the following conclusions:

Main problem:
The pinning results are not proportional to the number of dependency warnings of each type.

E.g.: If I get 1 or 100 containerImage warnings, the containerImage will be notPinned in pinning results, the dockerFromScore will be 0, cause it's 10 or 0, and this will affect 1/4 of my final score.

Side problems:

  • The dependencies of types goCommand, chocoCommand, npmCommand and pipCommand scores do not affect the final score.
  • The dependencies of types goCommand, chocoCommand, npmCommand and pipCommand generate warnings on JSON and on the Security Dashboard. The Security Dashboard should not be populated with warnings that do not affect the score.
  • The dependencies of type downloadThenRun affect both dockerDownloadScore and scriptScore in a way that the score is penalized twice for each downloadThenRun warning.

Describe the solution you'd like

I would like the pinning results to be proportional to the number os dependency warnings of each type, and the final score to be composed by all dependency types and not grouped into actionScore and etc.

Describe alternatives you've considered

None.

Additional context

None.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions