Google released a new one tool for developers that automates the procedure of projects and verifies some characteristics to ensure that the project has not been hacked. The new security tool is called AllStar and is designed to test and determine if certain critical features have changed.
The AllStar, combined with another Google tool called Scorecard, provides project maintainers with reassurance that their security settings are accurate, according to Jeff Mendoza, chief engineer at Google AllStars.
If developers want, they can also use the software score card to evaluate their project and then automatically provide the appropriate policies with AllStar.
Based on 18 distinct criteria, Scorecard evaluates projects, such as whether they are automatically updated, and uses an automated vulnerability detection method to detect defects that are easy to detect.
According to his announcement OpenSSF, Google released the tool as part of an effort to have software like AllStar that anyone can use. The software monitors a repository on GitHub and checks the project to ensure that no unwanted changes are made. The configuration settings are compared to the project security policy and if they do not match, there are "penalties".
Mendoza reports
With the popularity of the open code, attackers see a compromised project as a way to penetrate both closed and open systems. Attacks are made from the supply chain side: either with attacks on the code base, or with injections somewhere between the code and the way a project is developed and used in other systems.
