By giorgos | Published on 14-08-2021 12:05 | Categories: News
Google has released a new tool for developers that automates the process of saving projects and verifies certain features to ensure that the project is not compromised. The new security tool is called AllStar and is designed to test and determine if certain critical features have changed.
AllStar , combined with another Google tool called Scorecard, provides project maintainers with assurance that their security settings are accurate, according to Jeff Mendoza, lead engineer at Google's AllStars.
See more articles from iGuRu.gr when you search for news on Google.
If developers want, they can also use the software score card to evaluate their project and then automatically provide the appropriate policies with AllStar.
Based on 18 distinct criteria, Scorecard evaluates projects, such as whether they are automatically updated, and uses an automated vulnerability detection method to detect defects that are easy to detect.
According to the OpenSSF announcement , Google has made the tool available as part of an effort to make AllStar-like software available to anyone. The software monitors a repository on GitHub and checks the project to ensure that no unwanted changes are made. Configuration settings are compared to the project's security policy, and if they don't match, there are "penalties."
Mendoza reports
With the popularity of open source, attackers see a compromised project as a way of infiltrating both closed and open systems. Attacks are made from the supply chain side: either by attacks at the base of the code, or by injections somewhere between the code and the way a project has been developed and used in other systems.
