Adventures in Securing an Open Source Project: From Repo Security Zero to Hero
Talkat Open Source Summit Europe 2023 · on Tuesday, 2023-09-19· at 15:40· Room 0C (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
A deliberately sabotaged repository is scored with OpenSSF Scorecard, lowered to about 1.2/10 (GitHub defaults score ~4.5) and then hardened into the top 1% of over 1M projects. Steps shown include adding branch protection, enabling signed commits and automated releases, running dependency automation like dependabot, tightening workflow token permissions, and finally adding fuzzing. The demo lists exact score changes at each step and shows which settings or small add-ons produced the largest, quickest score jumps.
AI-written summary · about
chapters (12)
- 0:00Open source security intro
- 1:05Supply chain security
- 3:55Solo maintainer risks
- 6:02Project lifecycle risks
- 12:26Scorecard for security
- 16:20Sabotaging a project
- 18:06Basic security steps
- 21:20Branch protection & review
- 23:12Secure dependency management
- 25:40Safe package releases
- 28:28Advanced security tips
- 31:56Closing & Q&A
related talks
43mAdventures in Securing an Open Source Project: From Repo Security Zero...
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
20mBuilding Secure Software OpenSSF Best Practices for Everyone!
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
27mHow Do You Trust Your Open Source Software?
50mHow Do You Trust Open Source Software?
31mScorecard at Scale: Old and New Possibilities for Lifting Security on All Repositories
25mHow do you trust your open source software?