google / googlesource-auth-tools Goto Github PK

This issue was automatically created by Allstar.

Security Policy Violation
Project is out of compliance with Binary Artifacts policy: binaries present in source code

Rule Description
Binary Artifacts are an increased security risk in your repository. Binary artifacts cannot be reviewed, allowing the introduction of possibly obsolete or maliciously subverted executables. For more information see the Security Scorecards Documentation for Binary Artifacts.

Remediation Steps
To remediate, remove the generated executable artifacts from the repository.

Artifacts Found

• googlesource-cookieauth/googlesource-cookieauth

Additional Information
This policy is drawn from Security Scorecards, which is a tool that scores a project's adherence to security best practices. You may wish to run a Scorecards scan directly on this repository for more details.

Allstar has been installed on all Google managed GitHub orgs. Policies are gradually being rolled out and enforced by the GOSST and OSPO teams. Learn more at http://go/allstar

This issue will auto resolve when the policy is in compliance.

Issue created by Allstar. See https://github.com/ossf/allstar/ for more information. For questions specific to the repository, please contact the owner or maintainer.

Trying to run the following in a docker container:

FROM gcr.io/google.com/cloudsdktool/cloud-sdk
ENTRYPOINT ["bash"]
WORKDIR /app
RUN git clone https://github.com/google/googlesource-auth-tools.git githelper
RUN chmod +x githelper/googlesource-cookieauth/googlesource-cookieauth
RUN githelper/googlesource-cookieauth/googlesource-cookieauth

and gets the following error:

Cannot write cookies: cannot create a token for https://googlesource.com: credentials: cannot get a token: credentials: incomplete gcloud print-access-token result: &{ {}}

Any guidance as to what I'm doing wrong?

The context is:

• We have a private repo in golang, hosted on Google Source Repository (GSR)
• The go mod download uses git in the background
• and therefore requires the credential helper to connect to GSR
• I was hoping one could solve this with the above google-auth-tools library
• The above runs as part of a Google Cloud Build step (which has --network=cloudbuild set and therefore access to default credentials.)

We have identified 1 possible instance of outdated documentation:

• $HOME/.git-credential-cache/googlesource-cookieauth-cookie was deleted but the change has not been reflected in the current version of the README file

About

This is part of a research project that aims to automatically detect outdated documentation in GitHub repositories. We are evaluating the validity of our approach by identifying instances of outdated documentation in real-world projects.

We hope that this research will be a step towards keeping documentation up-to-date. If this has been helpful, consider updating the documentation to keep it in sync with the source code. If this has not been helpful, consider updating this issue with an explanation, so that we can improve our approach. Thanks!