Skip to content

Commit be38e51

Browse files
404-geek404-geek
committed
modify report according to sphinx and doc8 convention
Signed-off-by: 404-geek <pranayd61@gmail.com>
1 parent c6391a2 commit be38e51

File tree

2 files changed

+51
-20
lines changed

2 files changed

+51
-20
lines changed

‎docs/source/archive/gsoc-toc.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ GSoC 2024
1515
:maxdepth: 2
1616

1717
gsoc/reports/2024/scancode_toolkit_swastkk
18+
gsoc/reports/2024/scancode_scorecode_pranay
1819

1920
GSoC 2022
2021
---------

‎docs/source/archive/gsoc/reports/2024/scancode_scorecode_pranay.rst‎

Lines changed: 50 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
1-
==============================================================================
1+
====================================================================================
22
Integrating OpenSSF Scorecard into Scancode.io for Enhanced Vulnerability Analysis
3-
==============================================================================
3+
====================================================================================
4+
45

56
**Organization:** `AboutCode <https://aboutcode.org>`_
67

@@ -21,15 +22,25 @@ Integrating OpenSSF Scorecard into Scancode.io for Enhanced Vulnerability Analys
2122
Overview
2223
--------
2324

24-
The primary objective of this project was to integrate the OpenSSF Scorecard into the Scancode.io platform, thereby enhancing its capabilities for vulnerability analysis. The project involved work on two key repositories: `Scorecode`, which was developed as a PyPI package, and `Scancode.io`, where the integration with Scorecard data was implemented within scanning pipelines.
25+
The primary objective of this project was to integrate the OpenSSF Scorecard into the
26+
Scancode.io platform, thereby enhancing its capabilities for vulnerability analysis.
27+
The project involved work on two key repositories: `Scorecode`,which was developed as a
28+
PyPI package, and `Scancode.io`, where the integration with Scorecard data was
29+
implemented within scanning pipelines.
2530

2631
**Scorecode**
2732

28-
`Scorecode` serves as a PyPI package that encapsulates the business logic for fetching OpenSSF Scorecard data using the OpenSSF API. It also includes Django mixin models that can be extended and integrated into other platforms with databases, such as Scancode.io and PurlDB, ensuring seamless utilization of Scorecard data across various projects.
33+
`Scorecode` serves as a PyPI package that encapsulates the business logic for fetching
34+
OpenSSF Scorecard data using the OpenSSF API. It also includes Django mixin models that
35+
can be extended and integrated into other platforms with databases, such as Scancode.io
36+
and PurlDB, ensuring seamless utilization of Scorecard data across various projects.
2937

3038
**Scancode.io**
3139

32-
In the `Scancode.io` project, I developed a pipeline that interacts with the `Scorecode` package to fetch and store Scorecard data in the Scancode.io database. The data can then be exported into Bill of Materials (BOM) files in formats like CycloneDX and SPDX, providing comprehensive security insights in standardized formats.
40+
In the `Scancode.io` project, I developed a pipeline that interacts with the `Scorecode`
41+
package to fetch and store Scorecard data in the Scancode.io database. The data can then
42+
be exported into Bill of Materials (BOM) files in formats like CycloneDX and SPDX,
43+
providing comprehensive security insights in standardized formats.
3344

3445
--------------------------------------------------------------------------------
3546

@@ -38,18 +49,24 @@ Implementation
3849

3950
**1. Scorecode Repository:**
4051

41-
- Developed a PyPI package to interact with the OpenSSF API and fetch Scorecard data for various software packages.
42-
- Created Django mixin models to enable easy extension and integration of Scorecard data into platforms with databases like Scancode.io.
52+
- Developed a PyPI package to interact with the OpenSSF API and fetch Scorecard data
53+
for various software packages.
54+
- Created Django mixin models to enable easy extension and integration of Scorecard
55+
data into platforms with databases like Scancode.io.
4356

4457
**2. Scancode.io Integration:**
4558

46-
- Developed a pipeline within Scancode.io to call `Scorecode` functions, retrieve Scorecard data, and save it in the Scancode.io database.
47-
- Enhanced the existing BOM export functionality to include Scorecard data, allowing for detailed security posture analysis in CycloneDX and SPDX formats.
59+
- Developed a pipeline within Scancode.io to call `Scorecode` functions, retrieve
60+
Scorecard data, and save it in the Scancode.io database.
61+
- Enhanced the existing BOM export functionality to include Scorecard data, allowing
62+
for detailed security posture analysis in CycloneDX and SPDX formats.
4863

4964
**4. Testing:**
5065

51-
- Conducted comprehensive testing in both repositories to ensure accurate fetching, storage, and export of Scorecard data.
52-
- Verified seamless integration across different package ecosystems supported by Scancode.io.
66+
- Conducted comprehensive testing in both repositories to ensure accurate fetching,
67+
storage, and export of Scorecard data.
68+
- Verified seamless integration across different package ecosystems supported by
69+
Scancode.io.
5370

5471
--------------------------------------------------------------------------------
5572

@@ -100,7 +117,8 @@ Related Issues
100117
- Compute summary and clarity for EACH package in a codebase
101118
- `#3 <https://github.com/aboutcode-org/scorecode/issues/3>`_
102119
* - 5
103-
- Provide data values in scan results to correspond with license_clarity_score elements
120+
- Provide data values in scan results to correspond with license_clarity_score
121+
elements
104122
- `#2 <https://github.com/aboutcode-org/scorecode/issues/2>`_
105123

106124

@@ -116,35 +134,47 @@ Project Reference Links
116134
Pre GSOC Work
117135
-----------------------
118136

119-
Before GSoC officially started, I had the opportunity to contribute to the `ScanCode.io <https://github.com/aboutcode-org/scancode.io>`_ and `purldb.io <https://github.com/aboutcode-org/purldb>`_ project. During this
120-
period, I
121-
focused on enhancing various functionalities and laying the groundwork for the upcoming integration of the OpenSSF Scorecard. Below is a list of key pull requests I made:
137+
Before GSoC officially started, I had the opportunity to contribute to the
138+
`ScanCode.io <https://github.com/aboutcode-org/scancode.io>`_ and
139+
`purldb.io <https://github.com/aboutcode-org/purldb>`_ project. During this
140+
period, I focused on enhancing various functionalities and laying the groundwork for
141+
the upcoming integration of the OpenSSF Scorecard. Below is a list of key pull requests
142+
I made:
122143

123144
- `Add endpoint to create or update a package set <https://github.com/aboutcode-org/purldb/pull/350>`_
124145
- `Fixes Github Mapper route <https://github.com/aboutcode-org/purldb/pull/370>`_
125146
- `removed redundant PackageViewSet class code and added history field into package API nexB#389 nexB#221 <https://github.com/aboutcode-org/purldb/pull/390>`_
126147
- `alpine url bug fix and AGPL License version issue <https://github.com/aboutcode-org/scancode-toolkit/pull/3744>`_
127148

128-
These contributions were essential in building a solid foundation for the integration of the ScoreCode repository during GSoC.
149+
These contributions were essential in building a solid foundation for the integration of
150+
the ScoreCode repository during GSoC.
129151

130152
Post GSoC
131153
---------
132154

133-
After GSoC, the goal is to merge the pull requests into their respective repositories, enabling users to leverage the OpenSSF Scorecard integration for enhanced vulnerability analysis in Scancode.io. Future work includes extending this integration to other platforms like PurlDB.
155+
After GSoC, the goal is to merge the pull requests into their respective repositories,
156+
enabling users to leverage the OpenSSF Scorecard integration for enhanced vulnerability
157+
analysis in Scancode.io. Future work includes extending this integration to other
158+
platforms like PurlDB.
134159

135160
--------------------------------------------------------------------------------
136161

137162
Acknowledgements
138163
----------------
139164

140-
This project wouldn't have been possible without the incredible support and mentorship of an outstanding team:
165+
This project wouldn't have been possible without the incredible support and mentorship
166+
of an outstanding team:
141167

142168
- `Philippe Ombredanne <https://github.com/pombredanne>`_
143169
- `Ayan Sinha Mahapatra <https://github.com/AyanSinhaMahapatra>`_
144170
- `Thomas Druez <https://github.com/thomasdruez>`_
145171
- `Jonathan Yang <https://github.com/JonoYang>`_
146172
- `Tushar Goel <https://github.com/tushar-goel>`_
147173

148-
The weekly status calls were more than just updates; they were a source of inspiration, ideas, and camaraderie. And the 1:1 calls with `Ayan Sinha Mahapatra`_ and `Philippe Ombredanne`_ were like mini-masterclasses in software development.
174+
The weekly status calls were more than just updates; they were a source of inspiration,
175+
ideas, and camaraderie. And the 1:1 calls with `Ayan Sinha Mahapatra`_ and
176+
`Philippe Ombredanne`_ were like mini-masterclasses in software development.
149177

150-
To my mentors: Thank you for not just teaching me the ropes but for showing me how to swing from them! This journey was as much about learning as it was about having fun, and I couldn't have asked for a better crew to sail with.
178+
To my mentors: Thank you for not just teaching me the ropes but for showing me how to
179+
swing from them! This journey was as much about learning as it was about having fun,
180+
and I couldn't have asked for a better crew to sail with.

0 commit comments

Comments
 (0)