Adding scores for TT-Changes by aschemmel-tech · Pull Request #8 · eclipse-score/nlohmann_json

aschemmel-tech · 2025-12-01T15:50:42Z

No description provided.

coveralls · 2025-12-01T16:18:26Z

coverage: 99.186%. remained the same
when pulling e4dbb47 on aschemmel-tech-tt-changes-score
into f61e53b on main.

masc2023 · 2025-12-02T06:17:05Z

TSF/trustable/statements/JLS-06.md


 Pull requests in the nlohmann/json repository are merged only after code review.
+
+aschemmel-tech: taken over score from "OpenSSF Scorecard Report"


where can I find this Report?

You can find the report by opening the full JLS-06.md file, as the link is provided in the reference.

https://scorecard.dev/viewer/?uri=github.com%2Fnlohmann%2Fjson (as documented)

masc2023 · 2025-12-02T06:17:38Z

TSF/trustable/statements/JLS-07.md


 The develop branch of nlohmann/json is protected, i.e. no direct commits are possible.
+
+aschemmel-tech: no other pushes as from nlohman are observable


codeowner is defined, only nlohman is allowed to merge

masc2023 · 2025-12-02T06:20:18Z

.dotstop.dot

@@ -1,8 +1,8 @@
 # This file is automatically generated by dotstop and should not be edited manually.
-# Generated using trustable 2025.10.22.
+# Generated using trustable 2025.9.16.


It is a problem, if different version are used here? Why not always the same version, latest, is applied?

It is indeed strongly recommended to be consistent with the trudag version. This is enforced if one uses the dev container when editing or adding SME scores.

As can be seen, the script which installs trudag in the dev container is currently pinned to version 2025.10.22: https://github.com/eclipse-score/inc_nlohmann_json/blob/f61e53be2bba6d0e091a9bbe4252190e5e5f8019/.devcontainer/S-CORE/post_create_script.sh#L8

@aschemmel-tech Please reopen the project in the dev container as such:

I have problems updating my local trudag version. Cannot update at the moment.

masc2023 · 2025-12-02T06:30:52Z

TSF/trustable/statements/JLS-29.md

-Known bugs, misbehaviours and CVEs are analyzed and either fixed or mitigated in the nlohmann/json repository.
+Known bugs, misbehaviours and CVEs are analyzed and either fixed or mitigated in the nlohmann/json repository.
+
+aschemmel-tech: evidences support bugs and CVE fixing, no mitigation actions are offered.


Could not find any mitigation to a CVE report? Would not rate this so high, do you have evidences, beside some CVEs reported?

All CVEs were fixed or mitigated in nlohmann/json. As shown in the second reference in this statement, the are "0 existing vulnerabilities detected": https://scorecard.dev/viewer/?uri=github.com%2Fnlohmann%2Fjson#section-Vulnerabilities

masc2023 · 2025-12-02T06:31:36Z

TSF/trustable/statements/JLS-30.md

 ---

-Outstanding CVEs are analyzed within eclipse-score/inc_nlohmann_json to determine whether they can be dismissed, and/or are relevant for S-CORE's use cases of the nlohmann/json library.
+Outstanding CVEs are analyzed within eclipse-score/inc_nlohmann_json to determine whether they can be dismissed, and/or are relevant for S-CORE's use cases of the nlohmann/json library.


Could not find any analysis, only empty tickets reporting something, where are the analyzed?

The analysis comprises determining whether outstanding CVEs can be dismissed and/or are relevant for S-CORE.

The first reference in this statement shows that 0 CVEs are outstanding in nlohmann/json. The second reference shows which security alerts were dismissed as "false positive" or "used in test".

Within our development repo, the same steps were taken, to dismiss e.g., any false positives raised by code scanning tools. None are remaining now:

The same steps are to be taken for any security alerts raised by code scanning tools in https://github.com/eclipse-score/inc_nlohmann_json/security. So far, every single alert raised can be dismissed as false positive or used in test. Please however note that the detailed security page on github is only viewable by committers or administrators of the repo (I think). As such, I am not able to do so myself as I do not have the necessary permissions in eclipse-score.

Erikhu1

Many thanks for the SME scores. Just 2 remarks from my side:

It is highly recommended to use the dev container when performing the SME review. Doing so ensures that the correct version of trudag is being used. See my comment on .dotstop.dot below for more details on this.
To my understanding, the SME reviewer is not expected to motivate their scoring, especially not directly in the statement, as this would be displayed in the generated report:
- Instead, any feedback to the contributors of the TSF documentation (e.g., me), can be given directly, or as review comments to the contributors' PR, or proposed as merge requests. The feedback to the contributors shall however be separated from the SME scoring.
- Furthermore, if one SME does not agree with the SME score of another reviewer, they shall not try to convince the other party to change or edit their score. Instead, the opinion of the SME reviewer who disagrees with the existing scores should be reflected by simply putting their own scores.
- The point (that SMEs are not expected to motivate their scoring) might however be subject to change. CodeThink is currently looking at alternatives to allow SME reviewers to document the reasoning behind their scores (see tracked issue here https://gitlab.com/CodethinkLabs/trustable/trustable/-/issues/371).

Erikhu1 · 2025-12-02T07:51:49Z

TSF/trustable/statements/JLS-06.md


 Pull requests in the nlohmann/json repository are merged only after code review.
+
+aschemmel-tech: taken over score from "OpenSSF Scorecard Report"


You can find the report by opening the full JLS-06.md file, as the link is provided in the reference.

Erikhu1 · 2025-12-02T08:38:14Z

.dotstop.dot

@@ -1,8 +1,8 @@
 # This file is automatically generated by dotstop and should not be edited manually.
-# Generated using trustable 2025.10.22.
+# Generated using trustable 2025.9.16.


It is indeed strongly recommended to be consistent with the trudag version. This is enforced if one uses the dev container when editing or adding SME scores.

As can be seen, the script which installs trudag in the dev container is currently pinned to version 2025.10.22: https://github.com/eclipse-score/inc_nlohmann_json/blob/f61e53be2bba6d0e091a9bbe4252190e5e5f8019/.devcontainer/S-CORE/post_create_script.sh#L8

@aschemmel-tech Please reopen the project in the dev container as such:

Erikhu1 · 2025-12-02T09:29:16Z

TSF/trustable/statements/JLS-29.md

-Known bugs, misbehaviours and CVEs are analyzed and either fixed or mitigated in the nlohmann/json repository.
+Known bugs, misbehaviours and CVEs are analyzed and either fixed or mitigated in the nlohmann/json repository.
+
+aschemmel-tech: evidences support bugs and CVE fixing, no mitigation actions are offered.


All CVEs were fixed or mitigated in nlohmann/json. As shown in the second reference in this statement, the are "0 existing vulnerabilities detected": https://scorecard.dev/viewer/?uri=github.com%2Fnlohmann%2Fjson#section-Vulnerabilities

Erikhu1 · 2025-12-02T09:43:04Z

TSF/trustable/statements/JLS-30.md

 ---

-Outstanding CVEs are analyzed within eclipse-score/inc_nlohmann_json to determine whether they can be dismissed, and/or are relevant for S-CORE's use cases of the nlohmann/json library.
+Outstanding CVEs are analyzed within eclipse-score/inc_nlohmann_json to determine whether they can be dismissed, and/or are relevant for S-CORE's use cases of the nlohmann/json library.


The analysis comprises determining whether outstanding CVEs can be dismissed and/or are relevant for S-CORE.

The first reference in this statement shows that 0 CVEs are outstanding in nlohmann/json. The second reference shows which security alerts were dismissed as "false positive" or "used in test".

Within our development repo, the same steps were taken, to dismiss e.g., any false positives raised by code scanning tools. None are remaining now:

The same steps are to be taken for any security alerts raised by code scanning tools in https://github.com/eclipse-score/inc_nlohmann_json/security. So far, every single alert raised can be dismissed as false positive or used in test. Please however note that the detailed security page on github is only viewable by committers or administrators of the repo (I think). As such, I am not able to do so myself as I do not have the necessary permissions in eclipse-score.

aschemmel-tech · 2025-12-03T12:05:15Z

Without being able to state on which considerations a SME gives his score is for me a no-go. How would one be able to update the score later if something changes? Documenting in the PR as a review comment I do not see appropriate (because there is no relation to setting the score).
I have troubles updating the trudag version in my local environment. Could you please check if this has any impact on the hashes? The need for such local configuration should not exist.

Erikhu1

The points in my previous review comment were discussed in baselibs meeting 12/3/2025.

The current comments in the statements for motivating the SME score are to be kept as a temporary solution, while we monitor the progress of https://gitlab.com/CodethinkLabs/trustable/trustable/-/issues/371 .
While it is recommended to use the dev container to be consistent with the trudag version pinned, these specific version updates did not affect scoring or hashing, so ok for this time.

Adding scores for TT-Changes

e4dbb47

aschemmel-tech requested review from 4og and masc2023 as code owners December 1, 2025 15:50

github-actions bot added the L label Dec 1, 2025

aschemmel-tech requested a review from Erikhu1 December 1, 2025 15:51

github-actions bot removed the L label Dec 2, 2025

masc2023 reviewed Dec 2, 2025

View reviewed changes

Erikhu1 reviewed Dec 2, 2025

View reviewed changes

Erikhu1 approved these changes Dec 3, 2025

View reviewed changes

4og approved these changes Dec 10, 2025

View reviewed changes

masc2023 approved these changes Dec 10, 2025

View reviewed changes

aschemmel-tech merged commit ee6f77a into main Dec 10, 2025
86 checks passed

aschemmel-tech deleted the aschemmel-tech-tt-changes-score branch December 10, 2025 14:14


		Pull requests in the nlohmann/json repository are merged only after code review.

		aschemmel-tech: taken over score from "OpenSSF Scorecard Report"


		The develop branch of nlohmann/json is protected, i.e. no direct commits are possible.

		aschemmel-tech: no other pushes as from nlohman are observable

Conversation

aschemmel-tech commented Dec 1, 2025

Uh oh!

coveralls commented Dec 1, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Erikhu1 Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Erikhu1 Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Erikhu1 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Erikhu1 Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Erikhu1 Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aschemmel-tech commented Dec 3, 2025

Uh oh!

Erikhu1 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Erikhu1 Dec 2, 2025 •

edited

Loading

Erikhu1 Dec 2, 2025 •

edited

Loading

Erikhu1 left a comment •

edited

Loading

Erikhu1 Dec 2, 2025 •

edited

Loading

Erikhu1 Dec 2, 2025 •

edited

Loading