Scorecards workflow fails

[ahrtr]

What happened?

The Scorecards workflow fails.

Please see https://github.com/etcd-io/etcd/actions/runs/3333799872/jobs/5517612372

Could you take a look at this? cc @joycebrum

What did you expect to happen?

I expect it should be successful

How can we reproduce it (as minimally and precisely as possible)?

Please see the check results on the latest commit

Anything else we need to know?

No response

Etcd version (please run commands below)

$ etcd --version
# paste output here

$ etcdctl version
# paste output here

Etcd configuration (command line flags or environment variables)

paste your configuration here

Etcd debug information (please run commands blow, feel free to obfuscate the IP address or FQDN in the output)

$ etcdctl member list -w table
# paste output here

$ etcdctl --endpoints=<member list> endpoint status -w table
# paste output here

Relevant log output

No response

[ahrtr]

This seems the reason (see below). @joycebrum could you please clarify what update tool is needed? Is the failure caused by any recent commits in this repo (I doubt it)?

"score":0,"reason":"no update tool detected","name":"Dependency-Update-Tool"

[joycebrum]

@ahrtr, the error is actually this:

2022/10/27 04:41:03 error signing scorecard json results: error signing payload: getting key from Fulcio: verifying SCT: updating local metadata and targets: error updating to TUF remote mirror: tuf: invalid key

I've created an issue to Scorecard Team ossf/scorecard-action#998, but the version upgrade of scorecard github action seems to solve it. I'll open a PR with the solution, thanks for reaching me out 😄.

[ahrtr]

@ahrtr, the error is actually this:

2022/10/27 04:41:03 error signing scorecard json results: error signing payload: getting key from Fulcio: verifying SCT: updating local metadata and targets: error updating to TUF remote mirror: tuf: invalid key

I've created an issue to Scorecard Team ossf/scorecard-action#998, but the version upgrade of scorecard github action seems to solve it. I'll open a PR with the solution, thanks for reaching me out 😄.

Thanks @joycebrum Could you help me to understand why we ran into this issue without changing anything on Scorecard workflow configuration?

[ahrtr]

I'd like to get more clarification from @joycebrum before closing this issue.

[joycebrum]

@ahrtr I'm not sure why it started to happen out of nowhere.

I've openned this issue ossf/scorecard-action#998 to the Scorecard team and it seems to be related to the issue sigstore/cosign#2390 in sigstore.

[ahrtr]

@ahrtr I'm not sure why it started to happen out of nowhere.

I've openned this issue ossf/scorecard-action#998 to the Scorecard team and it seems to be related to the issue sigstore/cosign#2390 in sigstore.

Thank you @joycebrum