reporemedy 0.1.4

Project:

Package:

Development:

Contents

• Overview
• Installation
• Development
• Additional Information
• License

Overview

RepoRemedy aims to lower the barrier to software engineering best practices in open-source repositories. It will turn RepoAuditor text and OpenSSF Scorecard JSON findings into reviewable issues and pull requests.

How to use RepoRemedy

Read an existing report and write normalized findings and source provenance as JSON:

RepoRemedy inspect report.json --report-type ossf-scorecard --repo acme/demo
RepoRemedy inspect report.txt --report-type repoauditor --repo https://github.gatech.edu/sse-center/sse-resources

Use RepoRemedy inspect --help for inspection options and RepoRemedy --version for the installed version. OWNER/REPO means GitHub.com; use an HTTPS URL or HOST/OWNER/REPO for GitHub Enterprise. Enterprise hosts are retained in the output and Scorecard scan matching, including non-default HTTPS ports.

The inspect command reads reports offline. A separate publish command is planned for publishing reviewed proposals as issues or draft PRs, with explicit confirmation. See the design for the planned workflow.

Installation

Verifying Signed Artifacts

Artifacts are signed and verified using py-minisign and the public key in the file ./minisign_key.pub.

To verify that an artifact is valid, visit the latest release and download the .minisign signature file that corresponds to the artifact, then run the following command, replacing <filename> with the name of the artifact to be verified:

uv run --with py-minisign python -c "import minisign; minisign.PublicKey.from_file('minisign_key.pub').verify_file('<filename>'); print('The file has been verified.')"

Development

Please visit Contributing and Development for information on contributing to this project.

Additional Information

Additional information can be found at these locations.

License

RepoRemedy is licensed under the MIT license.