How Do You Trust Open Source Software?
summary
OpenSSF Scorecard is an automated scanner that assigns 0–10 scores per heuristic (starts at 10 then deducts) and exposes a public API plus a GitHub Action and badges; it scans about 1.2 million repositories and the action has ~2,600 installs. Checks include code review, a 90-day maintained heuristic and binary-artifact counting; sigstore is used for signing. Results feed deps.dev, Sonatype finds higher scores correlate with fewer future vulnerabilities, and the API returns recent scan data.
AI-written summary · about
chapters (23)
- 0:00Introduction to trust in OSS
- 1:07Defining trust in open source
- 3:19Jumpstarting trust with evidence
- 6:36Visualizing dependency risks
- 8:20Introducing OpenSSF Scorecards
- 11:36How Scorecard checks work
- 16:59Building trust programmatically
- 18:00State of supply chain security
- 20:09Scorecard adoption and growth
- 24:04Scorecard GitHub Action and badges
- 27:10Scorecard API overview
- 32:08Practical use cases for Scorecards
- 33:56Integrating Scorecards into workflows
- 35:20About the OpenSSF organization
- 36:04Q&A: Data licensing and badges
- 37:11Q&A: Badge updates and scans
- 39:02Q&A: Handling poorly maintained projects
- 41:09Q&A: Maintainer time and resources
- 43:15Q&A: SBOMs and Scorecard checks
- 44:38Q&A: Manual score adjustments
- 46:25Q&A: Mapping to security frameworks
- 47:07Q&A: Binary artifacts in GUIs
- 49:15Closing remarks
related talks
27mHow Do You Trust Your Open Source Software?
25mHow do you trust your open source software?
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
37mOpenSSF Best Practices for Everyone!
20mBuilding Secure Software OpenSSF Best Practices for Everyone!
41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...
36mEstimating Security Risk Through Repository Mining