How to mitigate C or bash pinned dependencies?

[spencerschrock]

Discussed in #3270

^{Originally posted by claudioandre-br July 15, 2023}
Hi,

I'm receiving this warning:

"Warn: downloadThenRun not pinned by hash: deploy/snap/build.sh:43",

Remediation steps says:

For C/C++, check in the code from a trusted source and add a README on the specific version used (and the archive SHA hashes).

• 1st, I tried to fix the issue by adding (inside build.sh):

echo "7a25fd926b9a7bc406dca6db5b2802a4a8a4625cc191b9ecdd1291bfcd1146ef  ./package_version.sh" | sha256sum -c - || exit 1

• 2nd, I tried to create some random README file(s) to mute the warning:
• Then run experiments [1]: /host/scorecard --local [...] --checks Pinned-Dependencies --show-details

Nothing was able to fix, remediate, "correct", "make right".

I'm asking:

• Is it possible to fix the issue?
• "add a README" (exactly where? name it as README, README.md?);
• "and the archive SHA hashes" (exactly how?);

[1]

$ /host/scorecard version
         __  ____     ____    ___    ____    _____    ____      _      ____    ____
        / / / ___|   / ___|  / _ \  |  _ \  | ____|  / ___|    / \    |  _ \  |  _ \
       / /  \___ \  | |     | | | | | |_) | |  _|   | |       / _ \   | |_) | | | | |
  _   / /    ___) | | |___  | |_| | |  _ <  | |___  | |___   / ___ \  |  _ <  | |_| |
 (_) /_/    |____/   \____|  \___/  |_| \_\ |_____|  \____| /_/   \_\ |_| \_\ |____/
./scorecard: OpenSSF Scorecard

GitVersion:    (devel)
GitCommit:     unknown
GitTreeState:  unknown
BuildDate:     unknown
GoVersion:     go1.18.1
Compiler:      gc
Platform:      linux/amd64
```</div>

[spencerschrock]

Related to #3339

[spencerschrock]

1st, I tried to fix the issue by adding (inside build.sh):

I think that matches the spirit of the check, but isn't something we currently support.

2nd, I tried to create some random README file(s) to mute the warning:

cc @laurentsimon I think when the check gets converted to structured results, providing a way to locally ignore certain probes might be a good idea. @gabibguti this may also factor in to maintainer annotations?

[github-actions]

This issue is stale because it has been open for 60 days with no activity.

[github-actions]

This issue is stale because it has been open for 60 days with no activity.

[github-actions]

This issue has been marked stale because it has been open for 60 days with no activity.