Comments (3)
I've taken a look at this issue and it has to do with argo's setup in OSS-Fuzz.
Specifically, Scorecard identifies that a project is fuzzed by OSS-Fuzz by comparing its URL to the main_repo
registered in project.yaml. In argo's case, that is main_repo: "https://github.com/argoproj"
, not [...]/argoproj/argo-cd
.
From what I can tell, the main_repo
is pointing to the org because the logic in https://github.com/google/oss-fuzz/blob/master/projects/argo actually fuzzes multiple different repositories at the same time.
This setup works well for the project and I in no means suggest changing it. But it unfortunately means Scorecard can't detect it. And there's currently no "workaround" to correct the Scorecard score for this, I'm afraid.
That being said, Scorecard will soon release a new major version (v5.0) that will include a new feature called "Maintainer annotations", which are meant to mitigate precisely this sort of issue. These annotations will allow maintainers to inform users that "hey, Scorecard didn't quite understand what's going on here".
from argo-cd.
I can see fuzzers in the cncf/fuzzing repo for argo-cd, and it is also integrated with OSS-Fuzz, but the fuzzing score remains 0. I am not sure why this is happening. Help from maintainers will be highly appreciated.
I've wondered about this myself. I assume it has something to do with how the OpenSSF Scorecard calculates the fuzzing score.
from argo-cd.
@crenshaw-dev should I proceed with the PR for this?
from argo-cd.
Related Issues (20)
- Enable git submodule HOT 4
- Ability to update cluster information including labels HOT 1
- changing destination from server to name causes constant app refresh HOT 5
- Use transforming informer for cluster cache
- Application controller can run out of disk space on '/dev/shm', when deploying concurrently to a large number of clusters, or with many large manifests
- ArgoCD does not set OutOfSync status after editing a deployed resource HOT 1
- [UI] App of Apps 'Go-To-Parent' Button on Application Details View HOT 6
- Argo CD versions release-2.9 and release-2.10 are pulling outdated versions of github.com/hashicorp/go-retryablehttp.
- Can't add docker-desktop cluster
- Need to disable pruning in my application in order to user can not use that option
- applicationSet syncPolicy docs vs CRD mismatch
- [Notifications] Make GH Check Runs part of ArgoCD Notifications natively
- Add Kubectl Option support like disable-compression
- API spec update - support just patching a single option versus entire app manifest HOT 4
- Test Health of namespace before other object when syncPolicy is set to syncOptions:[ CreateNamespace=true ]
- Conflicting result from `argocd admin settings rbac can` and `argocd account can-i` for logs RBAC
- Commas and dollar signs improperly passed to Helm
- Logs for deployment or container have `.txt` extension instead of `.log` HOT 4
- ArgoCD shows status as synced, but nothing in the kubernetes cluster is updated. HOT 6
- The notifications-controller logging level keeps in βinfoβ for argocd, although the config map argocd-cmd-params-cm configurarion is set to "error". HOT 11
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
π Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. πππ
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google β€οΈ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from argo-cd.