OpenSSF
The Open Source Security Foundation, a Linux Foundation project dedicated to improving the security of open-source software supply chains. It promotes coordinated investment by enterprises and communities in the security maintenance and vulnerability remediation of critical open-source projects.
Core Facts
The SLSA (Supply-chain Levels for Software Artifacts) framework, led by Google, divides software supply chain security capabilities into four levels.
The Heartbleed vulnerability existed in the OpenSSL codebase for more than two years before being discovered, directly leading to the establishment of the Core Infrastructure Initiative (CII, later evolved into OpenSSF).
Timeline (last 90 days)
Configuring independent GPG keys for bot accounts prevents attackers from forging bot commits to inject malicious code, a type of supply chain poisoning attack
The Linux Foundation established the Core Infrastructure Initiative (which later evolved into OpenSSF) in an attempt to provide financial support for critical open-source projects.
The Heartbleed vulnerability existed in the OpenSSL codebase for more than two years before being discovered, directly leading to the establishment of the Core Infrastructure Initiative (CII, later evolved into OpenSSF).
Open Source Security Foundation（OpenSSF）于2020年成立，推出了Scorecard、Sigstore等工具
All Facts (5)
The SLSA (Supply-chain Levels for Software Artifacts) framework, led by Google, divides software supply chain security capabilities into four levels.
65%VerifiedThe Heartbleed vulnerability existed in the OpenSSL codebase for more than two years before being discovered, directly leading to the establishment of the Core Infrastructure Initiative (CII, later evolved into OpenSSF).
65%UnverifiedConfiguring independent GPG keys for bot accounts prevents attackers from forging bot commits to inject malicious code, a type of supply chain poisoning attack
50%UnverifiedThe Linux Foundation established the Core Infrastructure Initiative (which later evolved into OpenSSF) in an attempt to provide financial support for critical open-source projects.
50%UnverifiedOpen Source Security Foundation（OpenSSF）于2020年成立，推出了Scorecard、Sigstore等工具
50%