ossf/scorecard fails to detect unpinned dependencies via chocolatey installer

[Alan-Jowett]

Example:

    - name: Set up OpenCppCoverage and add to PATH
      id: setup_opencppcoverage
      run: |
        choco install OpenCppCoverage -y
        echo "C:\Program Files\OpenCppCoverage" >> $env:GITHUB_PATH

This should detect an unpinned dependency.

I think this should require something like:

choco install -y --requirechecksum=true --checksum=2295A733DA39412C61E4F478677519DD0BB1893D88313CE56B468C9E50517888 --checksum-type=sha256 OpenCppCoverage

[laurentsimon]

Thanks for the report. You are right! Scorecard does not know about choco. Can you create this issue on the main scorecard repo? I'll show you where to add support.
We do something a similar check for pip and go, should be easy to add

[Alan-Jowett]

@laurentsimon thanks. Didn't realize this wasn't the main repo for scorecard. Can you provide a link?

[laurentsimon]

https://github.com/ossf/scorecard

[Alan-Jowett]

Moved:
ossf/scorecard#1807