Assessing Open Source Software Projects in the Software Supply Chain
summary
A small bash-based MVP aggregates public APIs and proprietary feeds to score OSS projects and produce JSON reports published to Confluence, then generates risk recommendations that narrow choices (example: six API gateway candidates reduced to two or three). The pipeline combines Hipcheck, Scorecard, Philm and other checks, finds dramatic dependency growth (92→7,151 dependency expansion for one component), flags malicious authors and code (XZ utils case), and has been run across 16,000 GitHub projects.
AI-written summary · about
chapters (14)
- 0:00Introduction and speakers
- 1:27Motivation for open source assessment
- 3:34Risk assessment challenges
- 7:08DOD criteria for open source
- 9:13Introducing the 4P framework
- 10:15Tools and data sources used
- 13:02Automation and context in vetting
- 14:05Report structure and thresholds
- 17:22Dependency analysis with SBOMs
- 20:13Case study with API Gateway
- 21:40Tool demonstration and results
- 24:10Alignment with DODCI memo
- 27:47Open source release and future plans
- 29:12Conclusion and call to action
related talks
27mHow Do You Trust Your Open Source Software?
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
41mManaging the risk and growth of using Open Source Software
25mHow do you trust your open source software?
27mSecuring the Software Supply Chain: Integrating OpenSSF Scorecard, Jenkins, and the O...
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
31mThe Value of OSS Management for Risk Mitigation
50mHow Do You Trust Open Source Software?