x/pkgsite: FR: add trust signals from deps.dev, OpenSSF

[Sajmani]

I'm posting this as a public issue to get a sense of community interest in this feature request.

What is the URL of the page with the issue?

Any package page, for example: https://pkg.go.dev/cloud.google.com/go/bigtable

What is your user agent?

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36

Screenshot

What did you do?

Looked for more information about whether this package is trustworthy.

What did you expect to see?

The deps.dev page for this package has lots of useful information, notably the OpenSSF scorecard:
https://deps.dev/go/cloud.google.com%2Fgo%2Fbigtable/v1.10.1

What did you see instead?

We should consider whether pkg.go.dev should display the same info, perhaps fetched via deps.dev's API, if it exposes this.

[c16a]

Would it be better if we embedded a link into pkgs.go.dev? Because so far, deps.dev doesn't expose an API.

[Sajmani]

I think we want users to see all the information they need to evaluate a package on pkg.go.dev, particularly in search results. We might also be interested in signals from other sources like goreportcard.com. We don't want the user to have to bounce between several sites to make their decision. S

…

On Sun, Aug 22, 2021 at 12:41 PM Chaitanya Munukutla < ***@***.***> wrote: Would it be better if we embedded a link into pkgs.go.dev? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#47463 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACKIVXKS2SOSBPSOH7VDH73T6ESCHANCNFSM5BG5N5DA> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&utm_campaign=notification-email> .