[Report issue] metal3-io

[jonathimer]

Page

https://insights.linuxfoundation.org/project/metal3/repository/metal3-io_cluster-api-provider-metal3/security?timeRange=past365days&start=2025-03-04&end=2026-03-04

Project

metal3-io

Describe the issue

OSPS-QA-05.01 reports text files as binaries, such as OWNERS and SECURITY_CONTACTS. They are yaml files, or markdown files or whatever files that do not have file extension, but are not executable and definitely not binary.

Steps to reproduce

https://insights.linuxfoundation.org/project/metal3/repository/metal3-io_cluster-api-provider-metal3/security

Expected vs. actual behavior

Text files that are not executable are not reported and the check passes.
This happens in all metal3-io repositories.

---

Jira Issue: DE-909

[tuminoid]

Slack discussion in TAG security slack: https://cloud-native.slack.com/archives/C08JZ9YLAA3/p1772603936336499

[tuminoid]

It seems LFX Insights is using old version of the scanner that struggles with extensionless files. That was fixed in ossf/pvtr-github-repo-scanner#219 and now we discuss in ossf/pvtr-github-repo-scanner#255 fixing the binary check that appeared from the PR 219 fix. After issue 255 gets a fix, it would be a good time to update the scanner on the LFX Insights side to get OSPS-QA-05.01 to show real results for quite a few projects and repos.