Bug: this.observer is null

[jmgate]

Motivation

I'm just starting a project to modify ossf/scorecard and scorecard-webapp such that we can deploy them internal to our company, for the sake of scanning repositories that can never leave our networks.

Problem

When building the webapp for the sake of viewing modifications locally, I've followed scorecards-site/README.md and done

nvm install 14
yarn install
yarn dev

but then when I open http://localhost:3000/ in the browser, it looks like the site starts to load, but then I run into the following:

Debugging

If I open the web developer tools and pull up the console, I can see:

I'm happy to try debugging further, but I have very little experience with web development, and I'm not sure what I should be looking for.

[spencerschrock]

Ignoring the error part for now as I'm also not familiar with that part.

Depending on your use cases for hosting the webapp (storing/serving results of your analyses of internal repos?), perhaps you're only interested in the Go portion of the webapp which is what handles api.scorecard.dev. scorecard.dev is almost entirely informational, except for scorecard.dev/viewer which is a static HTML file.

Which would either be this binary or the docker

scorecard-webapp/Makefile

Lines 5 to 10 in 31c568b

	scorecard-webapp: main.go app/server/*.go ## Runs go build on repo
	# Run go build and generate scorecard-webapp executable
	CGO_ENABLED=0 go build -trimpath -a -tags netgo -ldflags '$(LDFLAGS)' -o scorecard-webapp
	scorecard-webapp-docker: scorecard-webapp Dockerfile
	DOCKER_BUILDKIT=1 docker build . --file Dockerfile --tag scorecard-webapp

[jmgate]

We're hoping for the following:

• Provide GitLab CI/CD snippets that users can add to their .gitlab-ci.yml files to run the (modified) scorecard scanner on their internal GitLab repositories.
• The results of the scans will be pushed to some internal server running the part of the scorecard software that collects and stores the results.
• Users will be able to embed a badge showing their score in their README.
• Clicking the badge will pull up the appropriate page in the scorecard viewer.

If it's possible to do all this without building/serving all of scorecard.dev, I guess I'd be interested, but having some sort of splash page to explain what the service is doing and why would be beneficial for users as we try to educate everyone about software security best practices.

[jmgate]

See ossf/scorecard#4315 regarding modifications to the scanner itself.

[jmgate]

When I run yarn install, one of the warnings I see is

WARN:  No .env file found in /path/to/scorecard-webapp/scorecards-site.

Perhaps that's the root of the issue. Can you give me an idea of what variables are needed in there to stand up the site in development mode?

[spencerschrock]

The only environment variable we use while deploying is VUE_APP_FRONTEND=https://scorecard.dev.

I vaguely remember the dev site always doing this for me, but the production site not having the issue. so launching that should work as a stopgap:

yarn build
yarn start

[jmgate]

We went ahead and just deployed in production mode and are hacking on our production deployment. Feel free to close, if you like, but if you want to troubleshoot development mode, I'm happy to help.