GSoC 2024 GOSST

Implementing the OSSF Scorecard action and remediating the score across multiple NumFOCUS projects

Rationale

The project is focused on enhancing the security of NumFOCUS affiliate projects. This involves implementing continuous fuzzing for Open Source Software using Google's OSS-Fuzz and extending fuzzing coverage where it's already established. Additionally, the project aims to enhance security by automating builds and releases, integrating build provenance, implementing signing processes, and enhancing reproducibility.

Approach:

• The issue contains a list of projects where these features should be integrated. In the comments of each project we have an extra mentor designated to provide further assistance for that particular project.

Expected Outcomes:

• Project scorecards with good or acceptable scores, as demonstrated here

Source Code: https://github.com/numfocus/gsoc/issues/470

Associated Code:

• https://github.com/aeon-toolkit/aeon
• https://github.com/pymc-devs/pymc
• https://github.com/pymc-devs/pymc-examples
• https://github.com/pymc-devs/pymc-examples
• https://github.com/weecology/deepforest
• https://github.com/weecology/retriever
• https://github.com/jupyterlab/jupyterlab
• https://github.com/spyder-ide/spyder

Degree of difficulty

• Intermediate, Small (90 hours)

Skills:

• git/GitHub
• DevOps

Mentors

• @di
• @henrysenyondo