OpenSSF and the Industrialization of Open Source Security: What the Foundation Has Achieved

OpenSSF Scorecard: Measuring Security Posture

OpenSSF Scorecard is an automated tool that evaluates the security practices of an open source project and produces a score across 18 security checks. The checks include: whether the project has active maintenance, whether it uses branch protection, whether it uses code review, whether it implements fuzzing and SAST, whether dependencies are pinned, and whether releases are cryptographically signed. For organizations consuming open source, Scorecard provides an objective signal about maintenance health and security practices that complements CVSS vulnerability data. Integrating Scorecard assessments into your dependency selection process is recommended best practice.

SLSA: Supply Chain Levels for Software Artifacts

SLSA (pronounced "salsa") is a framework for evaluating and improving the security of software build processes. It defines four levels of supply chain security assurance, from SLSA 1 (basic build documentation) through SLSA 4 (hermetic, reproducible builds with two-party review). Each SLSA level provides specific assurances about the integrity of the build process — helping consumers understand the trustworthiness of the artifacts they are consuming. The XZ-utils attack, which compromised a build process rather than exploiting a code vulnerability, is exactly the threat SLSA is designed to address.

Sigstore: Cryptographic Signing for Open Source

Sigstore provides free, production-grade infrastructure for signing software artifacts and storing signatures in a transparency log (Rekor). The cosign tool enables container images, SBOMs, and other artifacts to be signed and verified. For SBOM programs specifically, Sigstore attestations enable verification that an SBOM was generated by a known, trusted build pipeline and has not been tampered with — addressing the authenticity concern about third-party SBOMs.

Alpha-Omega: Funding Critical Project Security

The Alpha-Omega project, funded by Microsoft, Google, Amazon, and others, provides security engineering resources to the most critical open source projects. Alpha focuses on the ~100 most critical open source projects (assessed by usage and impact), providing direct security engineering support. Omega focuses on the broader "long tail" of critical packages, using automated analysis to identify and fix security issues at scale. This addresses the chronic underfunding of security work in open source maintenance that allows vulnerabilities to persist for years.