Skip to content

Commit c602085

Browse files
committed
update the report with additional details
Signed-off-by: 404-geek <pranayd61@gmail.com>
1 parent 5d9f293 commit c602085

File tree

1 file changed

+79
-6
lines changed

1 file changed

+79
-6
lines changed

docs/source/archive/gsoc/reports/2024/scancode_scorecode_pranay.rst

Lines changed: 79 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ Integrating OpenSSF Scorecard into Scancode.io for Enhanced Vulnerability Analys
55
**Organization:** `AboutCode <https://aboutcode.org>`_
66

77
**Projects:** `Scancode.io <https://github.com/aboutcode-org/scancode.io>`_,
8-
`Scorecode <https://github.com/aboutcode-org/scorecode>`_
8+
`Scorecode <https://github.com/aboutcode-org/scorecode>`_
99

1010
**Mentee:** `Pranay Das (404-geek) <https://github.com/404-geek>`_
1111

@@ -23,11 +23,11 @@ Overview
2323

2424
The primary objective of this project was to integrate the OpenSSF Scorecard into the Scancode.io platform, thereby enhancing its capabilities for vulnerability analysis. The project involved work on two key repositories: `Scorecode`, which was developed as a PyPI package, and `Scancode.io`, where the integration with Scorecard data was implemented within scanning pipelines.
2525

26-
### Scorecode
26+
**Scorecode**
2727

2828
`Scorecode` serves as a PyPI package that encapsulates the business logic for fetching OpenSSF Scorecard data using the OpenSSF API. It also includes Django mixin models that can be extended and integrated into other platforms with databases, such as Scancode.io and PurlDB, ensuring seamless utilization of Scorecard data across various projects.
2929

30-
### Scancode.io
30+
**Scancode.io**
3131

3232
In the `Scancode.io` project, I developed a pipeline that interacts with the `Scorecode` package to fetch and store Scorecard data in the Scancode.io database. The data can then be exported into Bill of Materials (BOM) files in formats like CycloneDX and SPDX, providing comprehensive security insights in standardized formats.
3333

@@ -68,10 +68,83 @@ Linked Pull Requests
6868
- Open
6969
* - 2
7070
- https://github.com/aboutcode-org/scorecode/pull/5
71-
- Closed
71+
- Merged
7272
* - 2
7373
- https://github.com/aboutcode-org/scorecode/pull/1
74-
- Closed
74+
- Merged
7575
* - 2
7676
- https://github.com/aboutcode-org/scorecode/pull/4
77-
- Closed
77+
- Merged
78+
79+
80+
Related Issues
81+
--------------
82+
83+
.. list-table::
84+
:widths: 10 60 30
85+
:header-rows: 1
86+
87+
* - Sr. no
88+
- Name
89+
- Link
90+
* - 1
91+
- Store OSSF scorecard data in scancode.io models
92+
- `#1283 <https://github.com/aboutcode-org/scancode.io/issues/1283>`_
93+
* - 2
94+
- Show OSSF scorecard data in the UI as quality data
95+
- `#1284 <https://github.com/aboutcode-org/scancode.io/issues/1284>`_
96+
* - 3
97+
- Export OSSF scorecard data in SBOMs
98+
- `#1285 <https://github.com/aboutcode-org/scancode.io/issues/1285>`_
99+
* - 4
100+
- Compute summary and clarity for EACH package in a codebase
101+
- `#3 <https://github.com/aboutcode-org/scorecode/issues/3>`_
102+
* - 5
103+
- Provide data values in scan results to correspond with license_clarity_score elements
104+
- `#2 <https://github.com/aboutcode-org/scorecode/issues/2>`_
105+
106+
107+
Project Reference Links
108+
-----------------------
109+
110+
* `Project Idea <https://github.com/aboutcode-org/aboutcode/wiki/GSOC-2024-Project-Ideas#purldbscancodeio-enrich-an-sbom-based-on-ossf-security-score-card>`_
111+
112+
* `Official GSoC project page <https://summerofcode.withgoogle.com/programs/2024/projects/kB8HkEli>`_
113+
114+
* `GSoC Proposal <https://docs.google.com/document/d/10EiGjTGR_eZExMjcxEmwmMQPt7B9i6lHc_osW4Ogm6c/edit?usp=sharing>`_
115+
116+
Pre GSOC Work
117+
-----------------------
118+
119+
Before GSoC officially started, I had the opportunity to contribute to the `ScanCode.io <https://github.com/aboutcode-org/scancode.io>`_ and `purldb.io <https://github.com/aboutcode-org/purldb>`_ project. During this
120+
period, I
121+
focused on enhancing various functionalities and laying the groundwork for the upcoming integration of the OpenSSF Scorecard. Below is a list of key pull requests I made:
122+
123+
- `Add endpoint to create or update a package set <https://github.com/aboutcode-org/purldb/pull/350>`_
124+
- `Fixes Github Mapper route <https://github.com/aboutcode-org/purldb/pull/370>`_
125+
- `removed redundant PackageViewSet class code and added history field into package API nexB#389 nexB#221 <https://github.com/aboutcode-org/purldb/pull/390>`_
126+
- `alpine url bug fix and AGPL License version issue <https://github.com/aboutcode-org/scancode-toolkit/pull/3744>`_
127+
128+
These contributions were essential in building a solid foundation for the integration of the ScoreCode repository during GSoC.
129+
130+
Post GSoC
131+
---------
132+
133+
After GSoC, the goal is to merge the pull requests into their respective repositories, enabling users to leverage the OpenSSF Scorecard integration for enhanced vulnerability analysis in Scancode.io. Future work includes extending this integration to other platforms like PurlDB.
134+
135+
--------------------------------------------------------------------------------
136+
137+
Acknowledgements
138+
----------------
139+
140+
This project wouldn't have been possible without the incredible support and mentorship of an outstanding team:
141+
142+
- `Philippe Ombredanne <https://github.com/pombredanne>`_
143+
- `Ayan Sinha Mahapatra <https://github.com/AyanSinhaMahapatra>`_
144+
- `Thomas Druez <https://github.com/thomasdruez>`_
145+
- `Jonathan Yang <https://github.com/JonoYang>`_
146+
- `Tushar Goel <https://github.com/tushar-goel>`_
147+
148+
The weekly status calls were more than just updates; they were a source of inspiration, ideas, and camaraderie. And the 1:1 calls with `Ayan Sinha Mahapatra`_ and `Philippe Ombredanne`_ were like mini-masterclasses in software development.
149+
150+
To my mentors: Thank you for not just teaching me the ropes but for showing me how to swing from them! This journey was as much about learning as it was about having fun, and I couldn't have asked for a better crew to sail with.

0 commit comments

Comments
 (0)