From 81eab9d2d86c93a5d42f181fa7f5e444f77eeb6c Mon Sep 17 00:00:00 2001 From: Abhishek Arya Date: Mon, 26 Oct 2020 13:22:13 -0700 Subject: [PATCH] Add license header and code of conduct files. (#34) * Add license header and code of conduct files. * Fill missing field. --- CODE_OF_CONDUCT.md | 92 ++++++++++++++++++++++++++++++ contributing.md => CONTRIBUTING.md | 8 +-- LICENSE | 4 +- README.md | 6 +- checker/check.go | 14 +++++ checker/checker.go | 14 +++++ checks/active.go | 14 +++++ checks/all_checks.go | 14 +++++ checks/ci_tests.go | 14 +++++ checks/cii_best_practices.go | 14 +++++ checks/code_review.go | 14 +++++ checks/contributors.go | 14 +++++ checks/frozen_deps.go | 14 +++++ checks/fuzzing.go | 14 +++++ checks/ossfuzz.go | 14 +++++ checks/pull_requests.go | 14 +++++ checks/sast.go | 14 +++++ checks/security_policy.go | 14 +++++ checks/signed_releases.go | 14 +++++ checks/signed_tags.go | 14 +++++ cmd/root.go | 14 +++++ cmd/serve.go | 14 +++++ gen_github.sh | 14 +++++ main.go | 14 +++++ pkg/scorecard.go | 14 +++++ roundtripper/roundtripper.go | 14 +++++ 26 files changed, 409 insertions(+), 9 deletions(-) create mode 100644 CODE_OF_CONDUCT.md rename contributing.md => CONTRIBUTING.md (87%) diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 00000000..47e103be --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,92 @@ +# Code of Conduct + +## Our Pledge + +In the interest of fostering an open and welcoming environment, we as +contributors and maintainers pledge to making participation in our project and +our community a harassment-free experience for everyone, regardless of age, body +size, disability, ethnicity, gender identity and expression, level of +experience, education, socio-economic status, nationality, personal appearance, +race, religion, or sexual identity and orientation. + +## Our Standards + +Examples of behavior that contributes to creating a positive environment +include: + +* Using welcoming and inclusive language +* Being respectful of differing viewpoints and experiences +* Gracefully accepting constructive criticism +* Focusing on what is best for the community +* Showing empathy towards other community members + +Examples of unacceptable behavior by participants include: + +* The use of sexualized language or imagery and unwelcome sexual attention or + advances +* Trolling, insulting/derogatory comments, and personal or political attacks +* Public or private harassment +* Publishing others' private information, such as a physical or electronic + address, without explicit permission +* Other conduct which could reasonably be considered inappropriate in a + professional setting + +## Our Responsibilities + +Project maintainers are responsible for clarifying the standards of acceptable +behavior and are expected to take appropriate and fair corrective action in +response to any instances of unacceptable behavior. + +Project maintainers have the right and responsibility to remove, edit, or reject +comments, commits, code, wiki edits, issues, and other contributions that are +not aligned to this Code of Conduct, or to ban temporarily or permanently any +contributor for other behaviors that they deem inappropriate, threatening, +offensive, or harmful. + +## Scope + +This Code of Conduct applies both within project spaces and in public spaces +when an individual is representing the project or its community. Examples of +representing a project or community include using an official project e-mail +address, posting via an official social media account, or acting as an appointed +representative at an online or offline event. Representation of a project may be +further defined and clarified by project maintainers. + +This Code of Conduct also applies outside the project spaces when the Project +Steward has a reasonable belief that an individual's behavior may have a +negative impact on the project or its community. + +## Conflict Resolution + +We do not believe that all conflict is bad; healthy debate and disagreement +often yield positive results. However, it is never okay to be disrespectful or +to engage in behavior that violates the project’s code of conduct. + +If you see someone violating the code of conduct, you are encouraged to address +the behavior directly with those involved. Many issues can be resolved quickly +and easily, and this gives people more control over the outcome of their +dispute. If you are unable to resolve the matter for any reason, or if the +behavior is threatening or harassing, report it. We are dedicated to providing +an environment where participants feel welcome and safe. + +Reports should be directed to the Security Scorecard Authors. It is the Project +Steward’s duty to receive and address reported violations of the code of conduct. +They will then work with a committee consisting of representatives from the Open +Source Programs Office and the Google Open Source Strategy team. If for any +reason you are uncomfortable reaching out to the Project Steward, please email +opensource@google.com. + +We will investigate every complaint, but you may not receive a direct response. +We will use our discretion in determining when and how to follow up on reported +incidents, which may range from not taking action to permanent expulsion from +the project and project-sponsored spaces. We will notify the accused of the +report and provide them an opportunity to discuss it before any action is taken. +The identity of the reporter will be omitted from the details of the report +supplied to the accused. In potentially harmful situations, such as ongoing +harassment or threats to anyone's safety, we may take action without notice. + +## Attribution + +This Code of Conduct is adapted from the Contributor Covenant, version 1.4, +available at +https://www.contributor-covenant.org/version/1/4/code-of-conduct.html diff --git a/contributing.md b/CONTRIBUTING.md similarity index 87% rename from contributing.md rename to CONTRIBUTING.md index 3c802ab9..07a52444 100644 --- a/contributing.md +++ b/CONTRIBUTING.md @@ -1,9 +1,9 @@ -# Contributing to OSS Scorecards! +# Contributing to Security Scorecards! -Thank you for contributing your time and expertise to the OSS Scorecards project. +Thank you for contributing your time and expertise to the Security Scorecards project. This document describes the contribution guidelines for the project. -**Note:** Before you start contributing, you must read and abide by our **[Code of Conduct](./code-of-conduct.md)**. +**Note:** Before you start contributing, you must read and abide by our **[Code of Conduct](./CODE_OF_CONDUCT.md)**. ## Contributing code @@ -15,7 +15,7 @@ This document describes the contribution guidelines for the project. Then you can [iterate](#iterating). -## Environment Setup +### Environment Setup You must install these tools: diff --git a/LICENSE b/LICENSE index f49a4e16..15a7423e 100644 --- a/LICENSE +++ b/LICENSE @@ -186,7 +186,7 @@ same "printed page" as the copyright notice for easier identification within third-party archives. - Copyright [yyyy] [name of copyright owner] + Copyright 2020 Security Scorecard Authors Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -198,4 +198,4 @@ distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and - limitations under the License. \ No newline at end of file + limitations under the License. diff --git a/README.md b/README.md index 3ab08edc..d121019e 100644 --- a/README.md +++ b/README.md @@ -1,11 +1,11 @@ -# Open Source Scorecards +# Security Scorecards ## Motivation A short motivational video clip to inspire us: https://youtu.be/rDMMYT3vkTk "You passed! All D's ... and an A!" ## Goals -1. Fill the gaps that prevent automated analysis and trust decisions for measuring and reporting on the security posture of open source projects. +1. Automate analysis and trust decisions on the security posture of open source projects. 1. Use this data to proactively improve the security posture of the critical projects the world depends on. @@ -115,4 +115,4 @@ Many of the checks are based on heuristics, contributions are welcome to improve ## Contributing -See the [Contributing](contributing.md) documentation for guidance on how to contribute. +See the [Contributing](CONTRIBUTING.md) documentation for guidance on how to contribute. diff --git a/checker/check.go b/checker/check.go index ddb208e1..cca0508c 100644 --- a/checker/check.go +++ b/checker/check.go @@ -1,3 +1,17 @@ +// Copyright 2020 Security Scorecard Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + package checker type CheckResult struct { diff --git a/checker/checker.go b/checker/checker.go index 8d86071a..0a4b263a 100644 --- a/checker/checker.go +++ b/checker/checker.go @@ -1,3 +1,17 @@ +// Copyright 2020 Security Scorecard Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + package checker import ( diff --git a/checks/active.go b/checks/active.go index 88f6a6b5..e3868560 100644 --- a/checks/active.go +++ b/checks/active.go @@ -1,3 +1,17 @@ +// Copyright 2020 Security Scorecard Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + package checks import ( diff --git a/checks/all_checks.go b/checks/all_checks.go index 67e31e07..73b7994f 100644 --- a/checks/all_checks.go +++ b/checks/all_checks.go @@ -1,3 +1,17 @@ +// Copyright 2020 Security Scorecard Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + package checks import "github.com/dlorenc/scorecard/checker" diff --git a/checks/ci_tests.go b/checks/ci_tests.go index 9b17cb12..ebaa74f3 100644 --- a/checks/ci_tests.go +++ b/checks/ci_tests.go @@ -1,3 +1,17 @@ +// Copyright 2020 Security Scorecard Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + package checks import ( diff --git a/checks/cii_best_practices.go b/checks/cii_best_practices.go index 75679b36..91ade0f7 100644 --- a/checks/cii_best_practices.go +++ b/checks/cii_best_practices.go @@ -1,3 +1,17 @@ +// Copyright 2020 Security Scorecard Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + package checks import ( diff --git a/checks/code_review.go b/checks/code_review.go index fdc41521..2a59ac4a 100644 --- a/checks/code_review.go +++ b/checks/code_review.go @@ -1,3 +1,17 @@ +// Copyright 2020 Security Scorecard Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + package checks import ( diff --git a/checks/contributors.go b/checks/contributors.go index b30dc245..93ff0ba2 100644 --- a/checks/contributors.go +++ b/checks/contributors.go @@ -1,3 +1,17 @@ +// Copyright 2020 Security Scorecard Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + package checks import ( diff --git a/checks/frozen_deps.go b/checks/frozen_deps.go index f9dba249..7f9576d0 100644 --- a/checks/frozen_deps.go +++ b/checks/frozen_deps.go @@ -1,3 +1,17 @@ +// Copyright 2020 Security Scorecard Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + package checks import ( diff --git a/checks/fuzzing.go b/checks/fuzzing.go index 7e04e9f1..39254bcf 100644 --- a/checks/fuzzing.go +++ b/checks/fuzzing.go @@ -1,3 +1,17 @@ +// Copyright 2020 Security Scorecard Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + package checks import ( diff --git a/checks/ossfuzz.go b/checks/ossfuzz.go index a7fd5641..f2751bac 100644 --- a/checks/ossfuzz.go +++ b/checks/ossfuzz.go @@ -1,3 +1,17 @@ +// Copyright 2020 Security Scorecard Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + package checks // GENERATED CODE, DO NOT EDIT diff --git a/checks/pull_requests.go b/checks/pull_requests.go index 2a9bfbd0..970e10b2 100644 --- a/checks/pull_requests.go +++ b/checks/pull_requests.go @@ -1,3 +1,17 @@ +// Copyright 2020 Security Scorecard Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + package checks import ( diff --git a/checks/sast.go b/checks/sast.go index 3157a61d..5a6e3210 100644 --- a/checks/sast.go +++ b/checks/sast.go @@ -1,3 +1,17 @@ +// Copyright 2020 Security Scorecard Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + package checks import ( diff --git a/checks/security_policy.go b/checks/security_policy.go index 4f9e9492..aebdf64d 100644 --- a/checks/security_policy.go +++ b/checks/security_policy.go @@ -1,3 +1,17 @@ +// Copyright 2020 Security Scorecard Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + package checks import ( diff --git a/checks/signed_releases.go b/checks/signed_releases.go index 3e23d24a..5c26fe9a 100644 --- a/checks/signed_releases.go +++ b/checks/signed_releases.go @@ -1,3 +1,17 @@ +// Copyright 2020 Security Scorecard Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + package checks import ( diff --git a/checks/signed_tags.go b/checks/signed_tags.go index c2ff3d1f..720c2d07 100644 --- a/checks/signed_tags.go +++ b/checks/signed_tags.go @@ -1,3 +1,17 @@ +// Copyright 2020 Security Scorecard Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + package checks import ( diff --git a/cmd/root.go b/cmd/root.go index 1b33f672..45d910c9 100644 --- a/cmd/root.go +++ b/cmd/root.go @@ -1,3 +1,17 @@ +// Copyright 2020 Security Scorecard Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + package cmd import ( diff --git a/cmd/serve.go b/cmd/serve.go index a09d657e..1ceb0a6b 100644 --- a/cmd/serve.go +++ b/cmd/serve.go @@ -1,3 +1,17 @@ +// Copyright 2020 Security Scorecard Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + package cmd import ( diff --git a/gen_github.sh b/gen_github.sh index c70bfe67..4391136d 100755 --- a/gen_github.sh +++ b/gen_github.sh @@ -1,4 +1,18 @@ #!/bin/bash +# Copyright 2020 Security Scorecard Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + tmp=$(mktemp -d) trap "rm -rf $tmp" EXIT diff --git a/main.go b/main.go index c5ff7834..9d5a13b5 100644 --- a/main.go +++ b/main.go @@ -1,3 +1,17 @@ +// Copyright 2020 Security Scorecard Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + package main import "github.com/dlorenc/scorecard/cmd" diff --git a/pkg/scorecard.go b/pkg/scorecard.go index 21ae0548..76df8106 100644 --- a/pkg/scorecard.go +++ b/pkg/scorecard.go @@ -1,3 +1,17 @@ +// Copyright 2020 Security Scorecard Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + package pkg import ( diff --git a/roundtripper/roundtripper.go b/roundtripper/roundtripper.go index 55b3e21d..1294f7c5 100644 --- a/roundtripper/roundtripper.go +++ b/roundtripper/roundtripper.go @@ -1,3 +1,17 @@ +// Copyright 2020 Security Scorecard Authors +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + package roundtripper import (