Repository navigation
OpenSSF Scorecard for bagit repo? #179
Description
Thank you for developing bagit! Would it be possible to help users determine the security of the bagit repo by looking into some of the practices in the openssf scorecard recommendations?
Activity
acdha commentedon Oct 15, 2024
I guess my first question would be what benefit users would have for this. Nobody has asked for it and it's unclear to me that a project with no dependencies outside of the Python standard library would be a high priority for supply-chain monitoring.
peterk commentedon Oct 27, 2024
Bagit is included in other build chains. Knowing that bagit follows some of the OpenSSF practices would make it easier to trust the project. I understand if it feels cumbersome to implement all of the practices but it would help me and others mitigate risk if some of the practices were implemented.