6 Months In: (Building and) Using the OpenSSF Se...
summary
Six months of work produces a concrete model: a catalog of nine security capabilities from creation to retirement, mapped to real tools (Salsa for Salsa builds provenance, in-toto for attestations, SBOM scanners, CodeQL/trivy-type scans) and a live proof of concept that applies those pieces to a key persona Diana the weekend warrior. The project lists current gaps (missing signed attestations, storage and transport of metadata), runs weekly Tuesday calls, and hosts issues and PRs on the GitHub repo.
AI-written summary · about
chapters (13)
- 0:00OpenSSF Security Tool Belt intro
- 1:29Origin story and goals
- 4:24Key personas like Diana
- 9:09OpenSSF structure overview
- 10:12Integrating security tools challenges
- 13:27Proof of concept and engagement
- 18:01Security capabilities and patterns
- 23:42Call to action and participation
- 26:12Simplifying security for maintainers
- 27:57Cross-disciplinary collaboration
- 31:04Crowdsourcing security education
- 32:51How to get involved
- 33:13Q&A
related talks
33mHow & Why Does The Work of OpenSSF Impact You
57mFrontiers in Securing the Open Source Ecosystem
40mBuilding Developer Confidence in Software Security with the DevRel Community
42mDeveloping a Secure, Open Future
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
20mBuilding Secure Software OpenSSF Best Practices for Everyone!
14mKeynote: All Your Base Are Belong to Us
44mPanel Discussion: Summing Up the Summit: OpenSSF’s May 2022 Gathering and Action Plan