nordisk/ci-status

OpenSSF: Scorecard and test coverage of Gunnar, Holger and monetize

Lane OSSF-NEXT, 2026-10-30. OpenSSF Scorecard v5.6.0 in local mode (scorecard --local), the same tool and mode as the nightly scorecard-gunnar / scorecard-holger runs on STATUS.md. Local mode runs only the checks that read the files; Branch-Protection, CI-Tests, CII-Best-Practices, Code-Review, Contributors, Maintained, SBOM, Signed-Releases and Webhooks need a GitHub or GitLab API and are not run.

Scorecard, before and after

What changed:

• Vulnerabilities. Semver-compatible fixes in every lock (wasmtime 49.0.5, pageant, ammonia 4.2.4, quinn-proto 0.11.18, faster-hex 0.10.1, crypto-bigint 0.7). The SSH stack moved to russh 0.64.1: edda's nornir-git 0.2.3, and Gunnar's own SSH server and client. An advisory with no fixed release is triaged with a dated reason in deny.toml and in an osv-scanner.toml next to the lock that carries it (the file Scorecard reads); a test in each repository keeps the two equal. Gunnar still counts GHSA-q54r-jf2p-rfr2 (gix 0.88), which is reachable from its client's worktree checkout: it waits for the gix 0.90 bump.
• Fuzzing. A cargo-fuzz crate (fuzz/) in each repository: Gunnar 8 targets (pack, objects, the receive and upload requests, the gunnar-crypt envelope and files, commit and SSH signatures), Holger 6 (bundle verify, DSSE, in-toto, X.509, the APK index and the package metadata parsers). The first run found a real panic in Holger's bundle index reader (fixed). They run every night in the dwarves forge (fuzz-gunnar, fuzz-holger), and a crash is a red run.
• Dependency-Update-Tool. renovate.json in each repository. No Renovate bot runs on git.gunnar.rs; the forge's weekly deps-gunnar / deps-holger runs do the same work: cargo update in every lock, the repository's quick CI on that tree, and a new deps/update-<date>-<sha> branch when it is green. A person merges it.
• Pinned-Dependencies (Gunnar). The workflow actions by commit, the bench image by digest.
• Binary-Artifacts (Holger). Three of four binary fixtures are now built by the tests; one PyPI wheel stays, because its real Sigstore attestation covers exactly those bytes.

What cannot count without GitHub

• SAST counts only a .github/workflows file that runs CodeQL, Snyk, Pysa, Qodana or Hadolint, or SonarCloud named in a pom.xml. git.gunnar.rs runs no Actions, and the repositories have no GitHub mirror (owner rule), so a workflow file would run nowhere. The static analysis that does run: cargo clippy -D warnings and cargo deny on every push, and the nightly fuzzing.
• Branch-Protection, Code-Review, CI-Tests, Signed-Releases and the other API checks are not run in local mode at all.

Test coverage (cargo llvm-cov)

Measured on oden at lane time; from now on every night by coverage-gunnar and coverage-holger (05:00 UTC), whose numbers appear on STATUS.md.

monetize (lane MON-OSSF, 2026-10-31)

The open monetize crates (git.gunnar.rs/nordisk/monetize). The private vendors in monetize-impl are fuzzed too, but nothing of theirs is published here: their nightly run publishes its verdict only.

Scorecard, before and after

What changed:

• Vulnerabilities. wasmtime 49.0.5 (RUSTSEC-2026-0422/0423/0424) in five locks and pageant 0.2.5 (GHSA-662x-8wvj-2276) in three, by a semver-compatible lock move; a test keeps those floors. The rest is triaged with a dated reason in deny.toml and in an osv-scanner.toml beside each lock (xtask/tests/osv_triage.rs keeps them equal): the unmaintained compile-time crates and rsa/crypto-bigint as before, and the new russh advisories of 2026-10-30 (fixed only in russh 0.65) and gix 0.88, all under nornir-git in the tooling workspaces (xtask, monetize-fast, the build thing), none in a monetize binary. cargo-deny is clean in all seven workspaces.
• Fuzzing. fuzz/, five cargo-fuzz targets: pay_callback (the open vendors' callbacks), feed_config (the operator's feed and monetize.toml), signed_facts (snapshots, facts, go-aheads, growth, tickets), fleet_door (a box's signed Fleet call, the old sold-estate door folded in) and fleet_orders (the signed orders a box pulls). 300 s and then 1800 s per target on oden: 154 million runs, no crash. The forge runs them every night (fuzz-monetize), and the private vendors' crate (Stripe, Klarna, Swish) as fuzz-monetize-impl, verdict-only.
• Dependency-Update-Tool. renovate.json; the forge's weekly deps-monetize proposes the cargo update as a branch after the quick CI went green on it.
• Pinned-Dependencies, Token-Permissions. The one workflow (mirror-safety) pins actions/checkout to the commit of v4.4.0 and reads with contents: read only.
• Security-Policy. SECURITY.md.

Test coverage (cargo llvm-cov, lines), the open crates

Measured on oden over the whole open workspace at 65a1602a (the guests built first): 85.6 % (75655/88393 lines). Four crates were under 70 % and got tests (branch mon-ossf/cov-2026-10-31): fast-edge 22.3 % -> 88.3 %, monetize-pay-guest 67.3 % -> 99.0 %, monetize-cloud-guest 59.0 % -> 75.5 %, lake-product 20.0 % -> 72.9 %. From now on coverage-monetize measures the open crates every night (05:00 UTC) on STATUS.md.