How & Why Does The Work of OpenSSF Impact You
summary
OpenSSF focuses on concrete fixes: publish and consume SBOMs, push projects toward SLSA build levels, and fund signing, memory‑safety, vulnerability dashboards and a shared CVE dataset across ten investment streams. Demoed tools include pack and Cloud Native Buildpacks to produce container images and automatic SBOMs, and recommended adopting image signing (cosign/sigstore) and parameterless hermetic builds to reach SLSA guarantees. Log4j showed how far a compromise can ripple through Cloud Foundry components, motivating these exact actions.
AI-written summary · about
chapters (10)
- 0:00OpenSSF and open source impact
- 1:03Why OpenSSF and supply chain security
- 3:12Mainstream focus on supply chain security
- 8:08Log4j and supply chain attacks
- 12:07Software supply chains and risks
- 14:55What is OpenSSF
- 17:44OpenSSF’s ten streams
- 24:09Demo: build packs and SBOM generation
- 31:31Secure container workflows
- 32:14Summary and contribute
related talks
42mAction and Impact Panel: How OpenSSF and Industry Improve Open Source Security
57mFrontiers in Securing the Open Source Ecosystem
42mDeveloping a Secure, Open Future
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
37mOpenSSF Best Practices for Everyone!
20mBuilding Secure Software OpenSSF Best Practices for Everyone!
01h 16mCybersecurity with CDF & OpenSSF Focus Group
43mOur Dependence on Open Source Is Scary. SLSA, SBOM and Sigstore to the Rescue