Open Source Security
Open source security is the work of reducing risk in software whose source and development are public. It covers how projects protect code and releases, and how organizations choose, track, update, and verify the open source components they depend on.
itSoftware supply chain security | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Intro
Open Source Security
Open source security protects software that is developed in public and reused across organizational boundaries. Public source code supports inspection and collaboration, but visibility does not guarantee that anyone has reviewed a particular line, release, or dependency. Security depends on how a project governs changes, protects its development systems, handles vulnerabilities, and produces releases. It also depends on how downstream users select, verify, inventory, update, and operate those releases.
The central security boundary is a chain of trust. A maintainer accepts changes into a source repository. A build system turns a selected revision and its dependencies into artifacts. A package repository or download service distributes those artifacts. A consuming organization resolves a dependency, installs it, and runs it with some set of privileges and data access. An attacker can target any transition: a maintainer account, a pull request, a build runner, a package namespace, an update channel, or an unpatched deployment.
This chain creates shared responsibility. Maintainers control project governance, repository permissions, review rules, build isolation, release signing, and disclosure channels. Package repositories protect publishing identities and distribution metadata. Consumers decide which projects enter their environment, which versions are allowed, how quickly updates move, and what runtime privileges each component receives. Security tools supply evidence, but each role still makes risk decisions.
Two connected views
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://openssf.org/resources/guides/
Supports
- Evaluation, secure development, source management, and coordinated vulnerability disclosure guidance
- Roles and practices for open source maintainers, consumers, and security researchers
- https://baseline.openssf.org/
Supports
- Project security controls organized by maturity level and category
- Public criteria for assessing open source project practices
- https://csrc.nist.gov/pubs/sp/800/218/final
Supports
- Secure development practices, provenance tasks, and vulnerability response
- SSDF version 1.1 publication milestone
- https://www.cisa.gov/resources-tools/resources/cisa-open-source-software-security-roadmap
Supports
- Shared ecosystem responsibility and risk reduction goals
- Dependency visibility and support for critical open source infrastructure
- https://www.cisa.gov/sbom
Supports
- SBOM as machine-readable component transparency
- SBOM resources, formats, and use cases
- https://www.cisa.gov/sites/default/files/2024-08/SECURING_THE_SOFTWARE_SUPPLY_CHAIN_RECOMMENDED_PRACTICES_FOR_SOFTWARE_BILL_OF_MATERIALS_CONSUMPTION-508.pdf
Supports
- Connecting SBOM inventory with vulnerability and risk workflows
- Verification of component identity and applicability during triage
- https://slsa.dev/spec/v1.2/
Supports
- Source and build integrity, provenance, tracks, and levels
- Threats to build and release paths
- https://docs.sigstore.dev/about/overview/
Supports
- Artifact signing, identity, verification, and transparency logs
- Distinctions among checksums, signatures, and provenance
- https://github.com/ossf/oss-vulnerability-guide/blob/main/maintainer-guide.md
Supports
- Maintainer procedure for receiving, assessing, remediating, and communicating vulnerability reports
- https://github.com/sindresorhus/awesome
Supports
- Discovery of the curated Awesome Security list
- https://github.com/sbilly/awesome-security
Supports
- Discovery of Trivy, Preflight, cve-ape, and Keyscope as relevant ecosystem tools
- https://trivy.dev/docs/latest/
Supports
- Repository, filesystem, image, secret, vulnerability, and SBOM scanning
- Trivy Awesome Link rationale and landscape placement
- https://github.com/spectralops/preflight
Supports
- Inspection of scripts and executables for supply chain risk before use
- https://github.com/baalmor/cve-ape
Supports
- Offline-capable package and CVE scanning for test and continuous integration environments
- https://github.com/SpectralOps/keyscope
Supports
- Extensible validation of active secrets across supported services
- https://heartbleed.com/
Supports
- Heartbleed disclosure date and affected OpenSSL behavior
- https://www.linuxfoundation.org/blog/blog/never-let-a-good-crisis-go-to-waste-core-infrastructure-initiative
Supports
- Heartbleed as the catalyst for the Core Infrastructure Initiative
- Industry funding and identification of critical open source projects
- https://www.linuxfoundation.org/press/linux-foundation-announces-free-badge-program-to-help-boost-security-of-open-source-software
Supports
- May 2016 launch and purpose of the CII Best Practices Badge
- https://openssf.org/press-release/2020/08/03/technology-and-enterprise-leaders-combine-efforts-to-improve-open-source-security/
Supports
- August 2020 formation of OpenSSF and consolidation of earlier initiatives
- https://openssf.org/blog/2023/11/21/sigstore-simplifying-code-signing-for-open-source-ecosystems/
Supports
- Sigstore project origin in 2020 and its signing purpose
- https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-30.pdf
Supports
- May 2021 Executive Order 14028 and federal software supply chain action
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-356a
Supports
- December 2021 Log4Shell disclosure and affected Log4j releases
- https://openssf.org/blog/2023/10/16/reflections-on-2023-milestones-from-two-term-board-chair-jamie-thomas/
Supports
- April 2023 SLSA version 1.0 milestone and focus on build integrity
- https://www.cisa.gov/sites/default/files/2023-09/CISA-Open-Source-Software-Security-Roadmap-508c%20%281%29.pdf
Supports
- September 2023 roadmap publication and its four goals
- https://www.openwall.com/lists/oss-security/2024/03/29/4
Supports
- March 2024 disclosure of malicious code in xz release tarballs
- https://docs.github.com/en/code-security/dependabot
Supports
- Dependabot alerts and dependency update workflows
- https://docs.gitlab.com/user/application_security/dependency_scanning/
Supports
- GitLab pipeline dependency scanning and vulnerability workflow
- https://docs.snyk.io/scan-with-snyk/snyk-open-source
Supports
- Snyk Open Source software composition analysis capabilities
- https://www.mend.io/sca/
Supports
- Mend SCA component, vulnerability, and license governance
- https://www.sonatype.com/products/sonatype-lifecycle
Supports
- Sonatype Lifecycle component intelligence and policy controls
- https://docs.blackduck.com/
Supports
- Black Duck SCA portfolio component, vulnerability, and license workflows
- https://jfrog.com/xray/
Supports
- Xray artifact and repository software composition analysis
- https://anchore.com/enterprise/
Supports
- Anchore SBOM, container vulnerability, and policy workflows