• Stars
    star
    173
  • Rank 220,124 (Top 5 %)
  • Language
  • License
    Other
  • Created about 2 years ago
  • Updated 4 months ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

The S2C2F Project is a group working within the OpenSSF's Supply Chain Integrity Working Group formed to further develop and continuously improve the S2C2F guide which outlines and defines how to securely consume Open Source Software (OSS) dependencies into the developer’s workflow.

Secure Supply Chain Consumption Framework (S2C2F) SIG

secure package icon

The S2C2F SIG is a group working within the OpenSSF's Supply Chain Integrity Working Group formed to further develop and continuously improve the S2C2F guide which outlines and defines how to securely consume Open Source Software (OSS) dependencies into the developer’s workflow. This paper is split into two parts: a solution-agonistic set of practices and a maturity model-based implementation guide. The Framework is targeted toward organizations that do software development, that take a dependency on open source software, and that seek to improve the security of their software supply chain.

Motivation

OSS has become a critical aspect of any software supply chain. The S2C2F was designed based on known threats (i.e. tactics and techniques) used by adversaries to compromise OSS packages. By leveraging the framework, software development teams and organizations can securely consume OSS dependencies into the developer's workflow and enhance their OSS governance program to address threats specific to OSS consumption.

Objective

The objective for the S2C2F SIG is to develop and continuously improve upon a guide that provides the following:

  • A high-level solution-agnostic set of practices
  • A detailed list of requirements
  • A list of real-world supply chain threats specific to OSS, and how our Framework requirements mitigates them
  • A maturity model-based implementation guide, with links to tools from across the industry
  • A process for assessing your organization’s maturity
  • A mapping of the Framework requirements to 6 other supply chain specifications

View or Download the S2C2F Specification

⭐: Click here for the PDF of the specification

:atom:: Click here to view the specification in markdown

To learn more, the S2C2F FAQ is available here.

Get Involved

Quick Start

Meeting times

Governance

The GOVERNANCE.md outlines the scope and governance of our group activities.

SIG Maintainers

SIG Collaborators

More Repositories

1

scorecard

OpenSSF Scorecard - Security health metrics for Open Source
Go
4,323
star
2

criticality_score

Gives criticality score for an open source project
Go
1,307
star
3

allstar

GitHub App to set and enforce security policies
Go
1,232
star
4

package-analysis

Open Source Package Analysis
Go
718
star
5

wg-best-practices-os-developers

The Best Practices for OSS Developers working group is dedicated to raising awareness and education of secure code best practices for open source developers.
JavaScript
689
star
6

fuzz-introspector

Fuzz Introspector -- introspect, extend and optimise fuzzers
Python
359
star
7

wg-securing-critical-projects

Helping allocate resources to secure the critical open source projects we all depend on.
318
star
8

wg-security-tooling

OpenSSF Security Tooling Working Group
295
star
9

scorecard-action

Official GitHub Action for OpenSSF Scorecard.
Go
244
star
10

malicious-packages

A repository of reports of malicious packages identified in Open Source package repositories, consumable via the Open Source Vulnerability (OSV) format.
Go
229
star
11

wg-metrics-and-metadata

The purpose of the Metrics & Metadata (formerly Identifying Security Threats) working group is to enable stakeholders to have informed confidence in the security of open source projects. We do this by collecting, curating, and communicating relevant metrics and metadata from open source projects and the ecosystems of which they are a part.
222
star
12

wg-vulnerability-disclosures

The OpenSSF Vulnerability Disclosures Working Group seeks to help improve the overall security of the open source software ecosystem by helping mature and advocate well-managed vulnerability reporting and communication.
177
star
13

wg-supply-chain-integrity

Our objective is to enable open source maintainers, contributors and end-users to understand and make decisions on the provenance of the code they maintain, produce and use.
176
star
14

osv-schema

Open Source Vulnerability schema.
Python
173
star
15

secure-sw-dev-fundamentals

Secure Software Development Fundamentals courses (from the OpenSSF Best Practices WG)
CSS
168
star
16

package-manager-best-practices

Collection of security best practices for package managers.
157
star
17

census

📜Automated review of open source software projects
HTML
116
star
18

tac

Technical Advisory Council
106
star
19

security-reviews

A community collection of security reviews of open source software components.
Python
91
star
20

wg-securing-software-repos

OpenSSF Working Group on Securing Software Repositories
84
star
21

alpha-omega

Our mission is to catalyze sustainable improvements to critical open source software projects and ecosystems.
Open Policy Agent
77
star
22

package-feeds

Feed parsing for language package manager updates
Go
72
star
23

sbom-everywhere

Improve Software Bill of Materials (SBOM) tooling and training to encourage adoption
Vue
70
star
24

foundation

OpenSSF Governance and Legal Docs
68
star
25

Project-Security-Metrics

Collect, curate, and communicate relevant security metrics for open source projects.
Python
63
star
26

great-mfa-project

The Great Multi-Factor Authentication (MFA) Distribution Project of the Open Source Security Foundation (OpenSSF). We work to distribute hardware MFA tokens to critical open source software (OSS) projects.
52
star
27

security-insights-spec

OPENSSF SECURITY INSIGHTS: Repository for development of the draft standard, where requests for modification should be made via Github Issues.
48
star
28

ai-ml-security

Potential WG on Artificial Intelligence and Machine Learning (AI/ML)
43
star
29

scorecard-monitor

Simplify OpenSSF Scorecard tracking in your organization with automated markdown and JSON reports, plus optional GitHub issue alerts
JavaScript
31
star
30

wg-endusers

OpenSSF Endusers Working Group
28
star
31

ossf-landscape

26
star
32

scorecard-webapp

Website and API for OpenSSF Scorecard
HTML
21
star
33

DevRel-community

Evangelizing the mission and work of the OpenSSF and building strong community outreach around end-users, open-source maintainers, and contributors.
18
star
34

toolbelt

17
star
35

education

OpenSSF Education SIG
16
star
36

project-template

OpenSSF Project Template
16
star
37

Memory-Safety

15
star
38

omega-triage-portal

Python
13
star
39

scorecard-visualizer

Tool for visualizing the Open SSF Scorecard Api data in a human friendly way
TypeScript
12
star
40

Diagrammers-Society

OpenSSF Diagrammers Society
10
star
41

OpenVEX

Vuln Disclosure WG's new SIG
9
star
42

SIRT

The OSS-SIRT SIG (Open Source Software Security Incident Response Team Special Interest Group) is a group working within the OSSF's Vulnerability Disclosure Working Group that is focused on creating secure vulnerability management capabilities within the open source ecosystem to ensure effective coordinated vulnerability disclosure practices (CVD)
9
star
43

community

7
star
44

artwork

OpenSSF Artwork
7
star
45

gb-planning-committee

The Governing Board Planning Committee guides OpenSSF vision and planning including mission, roadmap, milestones and key metrics for success of the overall organization.
6
star
46

oss-researcher-vulnerability-guide

5
star
47

oss-compromises

Archive of various open source security compromises
5
star
48

github-org-access-scraper

GitHub lacks an API for listing an org's repos' access for non-team-based individuals, so, scrape it.
5
star
49

vulnerability-disclosures-whitepaper

4
star
50

S2C2F-attestation-schema-and-tool

Secure Supply Chain Consumption Framework (S2C2F) OSCAL Catalog and tool
Python
4
star
51

Governance-Committee

Governance Committee
3
star
52

disclosure-check

disclosure-check
Python
3
star
53

wg-dei

The Diversity, Equity, and Inclusion Working Group was formed in December 2023 to help increase representation and strengthen the overall effectiveness of the cybersecurity workforce.
3
star
54

si-tooling

Python
3
star
55

security-metrics-dashboard

3
star
56

homebrew-tap

2
star
57

open-auto-vuln-disclose

open-auto-vuln-disclose
Python
2
star
58

omega-moderne-client

Python
2
star
59

outreach

A place to connect about event and conference engagements
1
star
60

action-web-defn-check

GitHub action for checking a Web Application Definition file
1
star
61

.github

Github configuration
1
star
62

oss-analysis-census2-prototype

Prototype of Census 2 of open source software (NOT MAINTAINED)
Python
1
star
63

scorecard-dependencyanalysis

Scorecard action for checking when new dependencies are added to the repository.
Go
1
star