ossf/scorecard should detect unpinned dependencies via chocolatey installer

[Alan-Jowett]

Is your feature request related to a problem? Please describe.
ossf/scorecard should detect unpinned dependencies via chocolatey installer.

Describe the solution you'd like
ossf/scorecard should detect unpinned dependencies via chocolatey installer.

Describe alternatives you've considered
None.

Additional context
Example:

    - name: Set up OpenCppCoverage and add to PATH
      id: setup_opencppcoverage
      run: |
        choco install OpenCppCoverage -y
        echo "C:\Program Files\OpenCppCoverage" >> $env:GITHUB_PATH

This should detect an unpinned dependency.

I think this should require something like:

choco install -y --requirechecksum=true --checksum=2295A733DA39412C61E4F478677519DD0BB1893D88313CE56B468C9E50517888 --checksum-type=sha256 OpenCppCoverage

[gossts]

Great, thanks.

So the code to update is https://github.com/ossf/scorecard/blob/main/checks/shell_download_validate.go#L632
There are calls to isPipUnpinnedDownload(), isGoUnpinnedDownload(), etc you can take as example (called in the same function).

These functions are called from https://github.com/ossf/scorecard/blob/main/checks/pinned_dependencies.go, but you don't need to change these.

If you're interested in adding support, you'll also need to add some unit tests:
https://github.com/ossf/scorecard/blob/main/checks/pinned_dependencies_test.go

You should able to use existing test files from https://github.com/ossf/scorecard/tree/main/checks/testdata by adding your example in these files.

Let me know if you're interested in helping. I can give additional help if you need.

Thanks!

[Alan-Jowett]

Thanks for the pointers, I will take a stab at fixing this.