stacklok / trusty-action

Trusty Dependency Analysis Action

Trusty Dependency Analysis Action

Get a security and quality analysis of your dependencies with TrustyPkg!

Features

• Check if the dependencies are malicious, deprecated or archived
• Assess the quality and security of your dependencies using TrustyPkg activity hueristics
• See if it contains a source of origin to a legitimate code repository using sigstore and Trusty's historical provenance algorithm
• Understand if the package is a possible typo squatting attack
• Get a list of recommended alternatives to the dependency

Overview

This action takes any added dependencies within a pull request and assesses their quality using the Trusty API. If any dependencies are found to be below a certain threshold (See details below), the action will fail.

If any dependencies are malicious, deprecated, or archived, the action will also fail.

Full Language Support (inline with Trusty):

• Python
• JavaScript
• Java
• Rust
• Go

Usage

To use this action, you can add the following to your workflow:

name: TrustyPkg Dependency Check

on:
  pull_request:
    branches:
      - main

jobs:
  trusty_pkg_check:
    runs-on: ubuntu-latest
    name: Check Dependencies with TrustyPkg
    steps:
      - name: Checkout code
        uses: actions/checkout@v2

      - name: TrustyPkg Action
        uses: stacklok/[email protected]
        with:
          global_threshold: 5
          provenance_threshold: 5
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Inputs

Only one input is available for this action:

score_threshold: The minimum score required for a dependency to be considered high quality. Anything below this score will fail the action.

trusty-action's Issues

Full scan support

Allow the ability to perform a full trusty scan on pushes or a regular schedule.

Group dependencies by failed and succeeded

Also reformat the report for each of the dependencies to make it more compact

Extend threshold

Currently we fail the action, based on the overall trusty score

Perhaps we could also have other thresholds to fail if:

• typosquatting
• provenance (historical / sigstore)

Go generated trusty URLs are broken

See lukehinds/Demo-Repo-Go#3 (comment)

URLs are rendered as: https://www.trustypkg.dev/go/golang.org/x/sys

They should be: https://www.trustypkg.dev/go/golang.org%2Fx%2Fsys (or at least that is how the search function in trusty renders them).

Raise if repo is archived

There is an archive flag we can use:

    "archived": false,

Add details about provenance

Surface the provenance data into the github comment.

Display sigstore provenance if it has it, if not render some useful information about historical provenance (details of tags etc

If sigstore provenance is in the payload, display the provenance data in a similar to trusty:

Source repo:
https://github.com/sigstore/sigstore-js
GitHub Action Workflow:
.github/workflows/release.yml
Issuer:
CN=sigstore-intermediate,O=sigstore.dev
Rekor Public Ledger:
https://search.sigstore.dev/?logIndex=83491949

If historical provenance is in the payload, display the data in a similar to trusty:

Summarize package reports

Currently the report is expanded all the time. It can be difficult to read if there are hundreds of dependencies. We can have an initial summary table with the failure/success, then expanded on demand.

Highlight malicious failures on reports

When a malicious package is found, it needs to be more obvious, as it is an important blocker

Do not early return for score threshold

We can make the dep fail only if the global score is less than a threshold, but we still can show information about the dependency, malicious, deprecation, etc...