OpenSSF Scorecard hardening (token-permissions, signed-releases, vuln triage, image digests, CII badge)

[pallakatos]

OpenSSF Scorecard hardening — remaining items

Tracking the Scorecard findings. Two items are already addressed in flight:

• ✅ Vulnerabilities — RUSTSEC-2026-0185 (quinn-proto) fixed in fix(deps): bump quinn-proto to 0.11.15 (RUSTSEC-2026-0185) #409.
• ✅ Pinned-Dependencies (GitHub Actions) — pinned the 12 remaining @v4 GitHub-owned actions by SHA (OpenSSF Scorecard hardening (token-permissions, signed-releases, vuln triage, image digests, CII badge) #410).

Remaining (prioritized)

1. Token-Permissions (high) — move top-level contents/packages/actions/security-events: write to the specific jobs that need them; set top-level to read. Affected: release.yml, codeql.yml, blocklist-refresh.yml, image-cache-publish.yml, release-internal.yml, release-public-interim.yml. ⚠️ Touches release/signing jobs — change per-job + verify a full release run before merging.

2. Signed-Releases (high) — GitHub Release tarball assets aren't signed (container images already are: cosign keyless + SBOM + SLSA provenance). Add a cosign signature / SLSA provenance step for kars-cli-*.tgz + the binary tarballs in the release workflow.

3. Vulnerabilities (high) — triage the remaining OSV findings: RUSTSEC-2024-0370 (proc-macro-error unmaintained), RUSTSEC-2026-0173, RUSTSEC-2023-0071 (rsa Marvin — no fix), RUSTSEC-2025-0134, and GHSA-{4v58-8p28-2rq3,8m7c-8m39-rv4x,h67p-54hq-rp68,fx2h-pf6j-xcff,v6wh-96g9-6wx3,4x5r-pxfx-6jf8,848j-6mx2-7j84}. Bump where fixes exist; document accepted/unfixable (unmaintained transitive, no-patch advisories) in deny.toml / an osv-scanner ignore with rationale.

4. Pinned-Dependencies — container images & build commands (medium) — 18/26 container base images use mutable tags (mcr.microsoft.com/azurelinux/...:3.0). Pin by digest (Scorecard provides digests) — best paired with Renovate/Dependabot digest auto-updates so they don't rot. Also: pip/npm/go install commands not hash-pinned (largely covered by Cargo.lock / package-lock.json / vendored wheels, which Scorecard doesn't credit) — decide hash-pin vs. document.

5. Binary-Artifacts (high) — vendor/sandbox-wheels/*.whl (~130 wheels) are intentional: they make kars-sandbox-base build hermetically/offline with no PyPI dependency, and are tracked via LFS. This is a deliberate supply-chain tradeoff (vendored + checksummed > live PyPI pull). Document the rationale; evaluate whether Scorecard's allowlist/exemption mechanism applies.

6. CII-Best-Practices (low) — apply for the OpenSSF Best Practices badge.

Notes

• Many Scorecard checks penalize deliberate, security-positive choices here (vendored wheels; SHA-pinned-but-via-comment). Each item should be a small, independently-verifiable PR — especially Token-Permissions, which must not break the release/signing jobs.

[pallakatos]

Status update — 2026-06-23

Several items are now done; remaining ones are narrowed.

✅ Done

• Token-Permissions (Bump jsonwebtoken from 9.3.1 to 10.3.0 #1) — top-level permissions: contents: read across all workflows; packages/id-token/attestations/contents/security-events: write granted per-job only where used (ci(security): least-privilege token permissions (Scorecard) #412 + per-job perms in release-public-interim.yml, image-cache-publish.yml, codeql.yml, blocklist-refresh.yml, release.yml, release-internal.yml). Verified across full release runs (v0.1.0/0.1.1/0.1.2).
• Signed-Releases (chore(deps): bump rustls-webpki from 0.103.9 to 0.103.10 #2) — PR ci(release): sign release assets (Scorecard Signed-Releases) #421: the GitHub Release now ships a SHA256SUMS over every asset, cosign keyless-signed (SHA256SUMS.cosign.bundle) and SLSA build-provenance attested (gh attestation verify SHA256SUMS --repo Azure/kars). The npm CLI @kars-runtime/cli also carries its own SLSA provenance (npm audit signatures).
• Vulnerabilities — npm CLI — @kars-runtime/cli is now npm audit-clean (0 advisories). Dropped blessed-contrib (vulnerable transitive lodash/xml2js via map-canvas, no consumer-applicable fix) for a plain-blessed shim (cli/src/lib/operator-tui.ts). Also reviewed + accepted the Socket.dev execa 'obfuscated code' false positive.
• Binary-Artifacts (security: content safety and prompt shields fail-open is a bypass risk #5) & Pinned-Dependencies rationale (feat: replace hand-rolled governance.rs with agent-governance-toolkit dependency #4) — documented as deliberate, security-positive trade-offs in docs/security/supply-chain-posture.md (vendored+checksummed wheels for hermetic offline base-image builds; tag-not-digest base images so each rebuild pulls latest OS CVE fixes).

⏳ Remaining

• Vulnerabilities — Rust (fix(entrypoint): pre-create OpenClaw temp dirs and fix router log redirect #3) — triage current OSV/RUSTSEC findings; bump where fixed, document accepted/unfixable in osv-scanner.toml/deny.toml with rationale.
• Pinned-Dependencies — container image digests (feat: replace hand-rolled governance.rs with agent-governance-toolkit dependency #4) — pin base images by digest paired with Renovate digest auto-update (so we keep getting OS CVE patches). Net-new automation; deferred until Renovate is wired.
• CII-Best-Practices badge (feat: persistent trust store across pod recreations #6) — manual application at bestpractices.dev.