chore(security): close residual OSSF Scorecard Pinned-Dependencies gaps after #401 and #493

[WilliamBerryiii]

Affected Component

OSSF Scorecard Pinned-Dependencies check (currently normalized to 8/10).

Context

After PRs #401 (requirements.lock for Python tooling) and #493 (awk → cut plus DL3006 suppression on the OSS-Fuzz base image) merge, the Scorecard Pinned-Dependencies check still reports the following unpinned items. None of them are covered by an existing open issue.

This issue tracks closing every remaining gap so the check can return to 10, with the single permanent exception of the OSS-Fuzz upstream base image (no digest published; deduction is unavoidable).

Residual Findings

containerImage — 2 unpinned (excluding the OSS-Fuzz exception)

• src/500-application/509-sse-connector/services/connector-test-client/Dockerfile:1 — pin mcr.microsoft.com/azurelinux/base/python:3.12 to @sha256:8300706a0e644a7e260b6a464a1ae3967181ee9057a4accceaaf0ecdedb1d4a2
• src/500-application/509-sse-connector/services/sse-server/Dockerfile:1 — same pin

pipCommand — 4 unpinned

• src/500-application/510-onvif-connector/services/camera-dashboard/Dockerfile:18 — switch pip install -r requirements.txt to pip install --require-hashes -r requirements.txt; regenerate requirements.txt with uv pip compile --generate-hashes (matches the pattern already used by sibling SSE services)
• .clusterfuzzlite/build_python.sh:31 — pin the pyinstaller fallback install to pyinstaller==<ver> with --require-hashes against a tracked hash file
• .clusterfuzzlite/build_python.sh:35 — same treatment for atheris
• .clusterfuzzlite/build_python.sh:44 — pip install -r requirements.txt for harness service deps; depends on each harness service shipping a hashed requirements.txt. Scope this as "use --require-hashes and require harness services to provide hashed requirements"

npmCommand — 2 unpinned

• .clusterfuzzlite/build_js.sh:24 — replace npm install --no-audit --no-fund with npm ci; requires committing package-lock.json for src/500-application/513-tiered-notification-service
• .github/workflows/docs-automation.yml:110 — replace npm install -g markdown-link-check@3.14.2 with either:
  • a package-lock.json-backed npm ci + npx markdown-link-check, or
  • a pinned GitHub Action equivalent (e.g. gaurav-nelson/github-action-markdown-link-check@<sha>), which moves the dependency from npmCommand to the already-100%-pinned GitHubAction category

downloadThenRun — 2 unpinned

• src/100-edge/100-cncf-cluster/scripts/k3s-device-setup.sh:214 — curl -sfL https://get.k3s.io | sh -. Refactor to: download the installer to disk, verify SHA256 against a constant tracked alongside the pinned K3S_VERSION, then exec
• src/100-edge/100-cncf-cluster/scripts/k3s-device-setup.sh:227 — curl -LO https://dl.k8s.io/release/.../kubectl. Refactor to: fetch the version-matched checksum file from dl.k8s.io, verify the downloaded binary, then install

Permanent Exception

• .clusterfuzzlite/Dockerfile:17 — gcr.io/oss-fuzz-base/base-builder-rust. OSS-Fuzz does not publish digests for base-builder images. Scorecard will continue to deduct ~0.3 points; documented in PR fix(docker): replace awk with cut for hash verification in Dockerfiles and templates #493.

Acceptance Criteria

• All non-exception findings above resolved
• OSSF Scorecard Pinned-Dependencies check reports 9.7+ (10 minus the OSS-Fuzz deduction)
• CI green: container builds, k3s device setup script lint, fuzz workflow

Dependencies

• PR chore(python): add pip lock file for reproducible builds #401 (requirements.lock) — landed lockfile pattern that this issue extends to camera-dashboard
• PR fix(docker): replace awk with cut for hash verification in Dockerfiles and templates #493 (awk → cut + DL3006) — addresses the parallel hadolint cleanup; not blocking but reduces overlap

References

• Scorecard finding output: see issue conversation
• Scorecard Pinned-Dependencies docs: https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies