Open Source Security Foundation

Open Source Security Foundation
Open Source Security Foundation · Apache License 2.0 · source
Name	Open Source Security Foundation
Abbreviation	OpenSSF
Formed	2020
Type	Nonprofit organization
Headquarters	San Francisco, California
Parent organization	Linux Foundation

Open Source Security Foundation.

The Open Source Security Foundation is an initiative within the Linux Foundation launched in 2020 to improve security for widely used software components. It brings together actors from Microsoft Corporation, Google LLC, Amazon Web Services, IBM, Red Hat, Meta Platforms, Inc., GitHub, Intel Corporation, VMware, Oracle Corporation, Cisco Systems, Mozilla Foundation, SUSE, Canonical Ltd., NVIDIA Corporation, Salesforce, Stripe (company), Atlassian, Samsung Electronics, ARM Holdings and other stakeholders to coordinate efforts on supply chain security, vulnerability disclosure, and secure development. The initiative operates alongside initiatives such as the Core Infrastructure Initiative and complements standards from bodies like National Institute of Standards and Technology and policy work in venues such as the U.S. Department of Homeland Security and European Union Agency for Cybersecurity.

History

The project was announced in 2020 amid high-profile incidents involving SolarWinds, Log4Shell, and supply chain attacks affecting projects like Apache Log4j, which prompted coordinated responses from entities including CISA and the Cybersecurity and Infrastructure Security Agency. Founding participants included major technology firms and open source communities such as Debian, Fedora Project, Kubernetes, OpenSSL, Node.js, Python Software Foundation, Apache Software Foundation, Linux kernel, Rust Project, and the Free Software Foundation. Early initiatives aligned with recommendations from the Software Supply Chain Integrity discussions and echoed concerns raised in hearings by the United States Congress and reports from the Office of Management and Budget (United States) and National Telecommunications and Information Administration. Leadership drew on expertise from figures with backgrounds at Google, Microsoft, GitHub, Red Hat, and research institutions such as Carnegie Mellon University and University of California, Berkeley.

Mission and Governance

OpenSSF’s stated mission centers on improving security for widely used open source software projects and strengthening the software supply chain through collaboration among industry, academia, and community projects. Governance structures involve a board and working groups with participation from corporate members, foundations, and individual maintainers from projects like Kubernetes, OpenJDK, Python, Perl, PHP, Rust, Golang, Node.js Foundation, and Eclipse Foundation. The initiative coordinates with standards organizations including IETF, ISO, IEC, and advisory input from national agencies such as NIST, CISA, and the United Kingdom National Cyber Security Centre. Governance embraces initiatives modeled on practices from Apache Software Foundation and community stewardship patterns found in the Debian Project and Fedora Project.

Programs and Projects

OpenSSF sponsors programs and projects that bridge tool development, best practices, and research. Notable efforts include the Security Scorecards program, training initiatives, and vulnerability disclosure tooling that interacts with ecosystems like GitHub, GitLab, Bitbucket, and package registries such as npm, RubyGems, PyPI, Maven Central, and CRAN. Technical projects address secure build environments, binary transparency, and provenance using approaches influenced by in-toto, Sigstore, SLSA, and the Software Bill of Materials work evident in supply chain proposals by Google, Microsoft, and Red Hat. Research partnerships have linked to academic labs at Massachusetts Institute of Technology, Stanford University, University of Cambridge, and ETH Zurich, while tooling collaborations integrate with runtimes and platforms like Docker, Kubernetes, OpenShift, Helm, and Ansible. Initiatives also include support for auditing projects such as OpenSSL, LibreSSL, BoringSSL, GNU Privacy Guard, and cryptographic libraries maintained across numerous foundations.

Membership and Funding

Membership comprises corporate sponsors, foundation partners, and individual contributors from projects and universities. Major funders and supporters include Microsoft Corporation, Google LLC, Amazon Web Services, IBM, GitHub, Intel Corporation, Red Hat, VMware, Oracle Corporation, Mozilla Foundation, SUSE, and philanthropic bodies comparable to earlier efforts led by the Core Infrastructure Initiative. Funding mechanisms combine corporate sponsorship, grants, and in-kind contributions from companies with legal and policy inputs from entities such as the Open Source Initiative and advisory involvement from nonprofit groups like the Linux Foundation and The Linux Foundation Research. Membership tiers and working group seats follow models used by organizations such as Mozilla Foundation and Apache Software Foundation.

Impact and Criticism

The foundation’s activities influenced ecosystem practices including adoption of provenance standards like SLSA, enhancements to registry security for npm and PyPI, and tooling uptake across platforms such as GitHub Actions and GitLab CI/CD. Its work contributed to conversations at multilateral fora like the World Economic Forum and policy discussions in the European Commission and United States Congress. Critics have raised concerns paralleling debates involving Linux Foundation projects: potential corporate influence from major sponsors, prioritization of enterprise needs over small maintainer support, and questions about transparency compared with community-led governance exemplified by Debian Project and Apache Software Foundation. Other observers pointed to resource gaps for long-tail projects and compared outputs against standards produced by NIST and open processes championed by the Free Software Foundation. Proponents argue that collaboration among Microsoft, Google, Red Hat, IBM, and community projects produces pragmatic tooling and standards that raise baseline security across diverse ecosystems.

Category:Software security Category:Non-profit organizations based in California