Securing the open-source software supply chain is a huge deal. Last year, the Biden administration issued an executive order to improve software supply chain security. This came after the Colonial Pipeline ransomware attack shut down gas and oil deliveries throughout the southeast and the SolarWinds software supply chain attack. Securing software became a top priority. In response, The Open Source Security Foundation (OpenSSF) and Linux Foundation rose to this security challenge. Now, they’re calling for $150 million in funding over two years to fix ten major open-source security problems.
They’ll need every penny of it and more.
The government will not be paying the freight for these changes. $30 million has already been pledged by Amazon, Ericsson, Google, Intel, Microsoft, and VMWare. More is already on the way. Amazon Web Services (AWS) has already pledged an additional $10 million.
At the White House press conference, OpenSSF general manager Brian Behlendorf said, “I want to be clear: We’re not here to fundraise from the government. We did not anticipate needing to go directly to the government to get funding for anyone to be successful.”
Here are the ten goals the open-source industry is committed to meeting.
Security Education: Deliver baseline secure software development education and certification to all.
Risk Assessment: Establish a public, vendor-neutral, objective-metrics-based risk assessment dashboard for the top 10,000 (or more) OSS components.
Digital Signatures: Accelerate the adoption of digital signatures on software releases.
Memory Safety: Eliminate root causes of many vulnerabilities through the replacement of non-memory-safe languages.
Incident Response: Establish the OpenSSF Open Source Security Incident Response Team, security experts who can step in to assist open source projects during critical times when responding to a vulnerability.
Better Scanning: Accelerate the discovery of new vulnerabilities by maintainers and experts through advanced security tools and expert guidance.
Code Audits: Conduct third-party code reviews (and any necessary remediation work) of up to 200 of the most-critical OSS components once per year.
Data Sharing: Coordinate industry-wide data sharing to improve the research that helps determine the most critical OSS components.
Software Bill of Materials (SBOMs): Everywhere Improve SBOM tooling and training to drive adoption.
Improved Supply Chains: Enhance the 10 most critical open-source software build systems, package managers, and distribution systems with better supply chain security tools and best practices.
I’ll go into more detail about those in later stories, but even at a glance, this is a massive undertaking. For instance, C, which is core to the Linux kernel, the most important of all open-source projects, has many vulnerabilities within it. While the memory-safe Rust language is now being used in Linux, it’s years, decades away, from replacing C in Linux’s over 27.8 million lines of code. Indeed, I doubt we’ll ever see all of Linux’s C code replaced by Rust.
We’re already close to solving some of the others. The open-source security company Chainguard is calling on the software industry to standardize on Sigstore. Sigstore enables developers to securely sign software artifacts such as release files, container images, binaries, bills of material manifests. and more. This Linux Foundation project is backed by Google, Red Hat, and Purdue University.
Sigstore has several great features. These include:
Sigstore’s keyless signing gives a great developer experience and removes the need for painful key management.
Sigstore’s public transparency log (Rekor) and APIs mean Kubernetes consumers may easily verify signed artifacts.
Sigstore’s use of standards, such as support for any Open Container Initiative (OCI) artifact (including containers, Helm Charts, configuration files, and policy bundles) and OpenID Connect (OIDC), means it integrates seamlessly with other tools and services.
The active, open-source, vendor-neutral Sigstore community gives confidence that the project will be rapidly adopted and become a de-facto industry standard.
Indeed, Kubernetes has already adopted Sigstore. In brief, it makes it simple to adopt a secure digital signature for your code. Then, the programmers who use your code can be sure it really is the code they want and can trust.
This is essential. As Stephen Chin, software chain security company JFrog VP of Developer Relations, said, “While open source has always been seen as a seed for modernization, the recent rise of software supply chain attacks has demonstrated we need a more hardened process for validating open-source repositories.”
Of course, there will always be bugs. As Behlendorf said, “Software will never be perfect. The only software that doesn’t have any bugs is software with no users.”
Related Stories:
