No Binary Artifacts

ID

openssf_scorecard/binary_artifacts

Severity

critical

Category

Levels

Optional

false

Tags

security, supply-chain

Description

Is the project free of checked-in binaries?

The project should not have generated executable (binary) artifacts in the source repository.

Reference: OSSF Scorecard - binary artifacts.

Rationale

Including generated executables in the source repository increases user risk. Many programming language systems can generate executables from source code (e.g., C/C++ generated machine code, Java .class files, Python .pyc files, and minified JavaScript). Users will often directly use executables if they are included in the source repository, leading to many dangerous behaviors.

Problems with generated executable (binary) artifacts:

  • Binary artifacts cannot be reviewed, allowing possible obsolete or maliciously subverted executables. Reviews generally review source code, not executables, since it’s difficult to audit executables to ensure that they correspond to the source code. Over time the included executables might not correspond to the source code.

  • Generated executables allow the executable generation process to atrophy, which can lead to an inability to create working executables. These problems can be countered with verified reproducible builds, but it seems easier to implement verified reproducible builds when executables are not included in the source repository (since the executable generation process is less likely to have atrophied).

Verification

The checkpoint compliance fails when there is a single binary executable file in the source repository for the project.

Remediation

  • Remove the generated executable artifacts from the repository.

  • Build from source.

Small Print

Many language platforms directly run source code (using interpreters or just-in-time compilers): the source code is executable but reviewable, so it is not considered by this check. This includes shell scripts.

Generated source code, like parsers from parser-generation tools from a grammar specification, or annotated source code that is "transpiled" into generated code, is not considered "binary artifact". Generated source code could be more difficult to review than human-written code (some may argue that there are obfuscation-loving programmers out there), and it is recommended to have the tools for re-generating the code from the initial specification.

Generated documentation in source repositories is also ignored. Generated documentation is intended for use by humans (not computers) who can evaluate the context. Thus, generated documentation doesn’t pose the same level of risk.

Non-executable binary files, like images, videos, and other content, are not considered binary executables for this check.