How to mitigate C or bash pinned dependencies?

[claudioandre-br]

Hi,

I'm receiving this warning:

"Warn: downloadThenRun not pinned by hash: deploy/snap/build.sh:43",

Remediation steps says:

For C/C++, check in the code from a trusted source and add a README on the specific version used (and the archive SHA hashes).

• 1st, I tried to fix the issue by adding (inside build.sh):

echo "7a25fd926b9a7bc406dca6db5b2802a4a8a4625cc191b9ecdd1291bfcd1146ef  ./package_version.sh" | sha256sum -c - || exit 1

• 2nd, I tried to create some random README file(s) to mute the warning:
• Then run experiments [1]: /host/scorecard --local [...] --checks Pinned-Dependencies --show-details

Nothing was able to fix, remediate, "correct", "make right".

I'm asking:

• Is it possible to fix the issue?
• "add a README" (exactly where? name it as README, README.md?);
• "and the archive SHA hashes" (exactly how?);

[1]

$ /host/scorecard version
         __  ____     ____    ___    ____    _____    ____      _      ____    ____
        / / / ___|   / ___|  / _ \  |  _ \  | ____|  / ___|    / \    |  _ \  |  _ \
       / /  \___ \  | |     | | | | | |_) | |  _|   | |       / _ \   | |_) | | | | |
  _   / /    ___) | | |___  | |_| | |  _ <  | |___  | |___   / ___ \  |  _ <  | |_| |
 (_) /_/    |____/   \____|  \___/  |_| \_\ |_____|  \____| /_/   \_\ |_| \_\ |____/
./scorecard: OpenSSF Scorecard

GitVersion:    (devel)
GitCommit:     unknown
GitTreeState:  unknown
BuildDate:     unknown
GoVersion:     go1.18.1
Compiler:      gc
Platform:      linux/amd64

[spencerschrock]

Hi, I've converted this to an issue instead for better visibility. #3401

[claudioandre-br]

Thank you