Signed-Tags checks fail <div class="snippet-clipboard-content notranslate position

<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/us

Signed-Tags checks fail on certain repositories about scorecard HOT 4 CLOSED

ossf commented on June 12, 2024

Signed-Tags checks fail on certain repositories

from scorecard.

Comments (4)

inferno-chromium commented on June 12, 2024 1

I think I know what the problem is. I am on vacation and planning to do a PR start of the new year!

Perfect, enjoy the holidays and merry christmas! see you in new year!

from scorecard.

inferno-chromium commented on June 12, 2024

@naveensrinivasan - do you have ideas on a fix here ? Thanks for finding an example

from scorecard.

naveensrinivasan commented on June 12, 2024

I think I know what the problem is. I am on vacation and planning to do a PR start of the new year!

from scorecard.

naveensrinivasan commented on June 12, 2024

The reason the tags aren't working for certain repositories is that because the Lightweight Tags vs Annotated Tags

Basically, lightweight tags are just pointers to specific commits. No further information is saved; on the other hand, annotated tags are regular objects, which have an author and a date and can be referred because they have their own SHA key.

https://api.github.com/repos/ossf/scorecard/git/refs/tags

[
  {
    "ref": "refs/tags/v1.0.0",
    "node_id": "MDM6UmVmMzAyNjcwNzk3OnJlZnMvdGFncy92MS4wLjA=",
    "url": "https://api.github.com/repos/ossf/scorecard/git/refs/tags/v1.0.0",
    "object": {
      "sha": "87997ffb5724cb479223a08a2890c60b0ea4bfbd",
      "type": "commit",
      "url": "https://api.github.com/repos/ossf/scorecard/git/commits/87997ffb5724cb479223a08a2890c60b0ea4bfbd"
    }
  },
  {
    "ref": "refs/tags/v1.1.0",
    "node_id": "MDM6UmVmMzAyNjcwNzk3OnJlZnMvdGFncy92MS4xLjA=",
    "url": "https://api.github.com/repos/ossf/scorecard/git/refs/tags/v1.1.0",
    "object": {
      "sha": "f2c633854602cf0c8f33164a169fb0a8454bee01",
      "type": "tag",
      "url": "https://api.github.com/repos/ossf/scorecard/git/tags/f2c633854602cf0c8f33164a169fb0a8454bee01"
    }
  }
]

Annotated tags

https://api.github.com/repos/kubernetes/kubernetes/git/refs/tags

[
  {
    "ref": "refs/tags/v0.2",
    "node_id": "MDM6UmVmMjA1ODA0OTg6cmVmcy90YWdzL3YwLjI=",
    "url": "https://api.github.com/repos/kubernetes/kubernetes/git/refs/tags/v0.2",
    "object": {
      "sha": "64dbf9ae21dd0deb485f88b79b96eb35ca855138",
      "type": "tag",
      "url": "https://api.github.com/repos/kubernetes/kubernetes/git/tags/64dbf9ae21dd0deb485f88b79b96eb35ca855138"
    }
  }
  ]

The look for the tag fails because of there isn't a tag object but only a commit object.
https://api.github.com/repos/ossf/scorecard/git/commits/87997ffb5724cb479223a08a2890c60b0ea4bfbd

from scorecard.

Recommend Projects