doytsujin / s2c2f

The S2C2F SIG is a group working within the OpenSSF's Supply Chain Integrity Working Group formed to further develop and continuously improve the S2C2F guide which outlines and defines how to securely consume Open Source Software (OSS) dependencies into the developer’s workflow.

Secure Supply Chain Consumption Framework (S2C2F) SIG

The S2C2F SIG is a group working within the OpenSSF's Supply Chain Integrity Working Group formed to further develop and continuously improve the S2C2F guide which outlines and defines how to securely consume Open Source Software (OSS) dependencies into the developer’s workflow. This paper is split into two parts: a solution-agonistic set of practices and a maturity model-based implementation guide. The Framework is targeted toward organizations that do software development, that take a dependency on open source software, and that seek to improve the security of their software supply chain.

Motivation

[Background / use cases of the problem to be solved]

Objective

The objective for the S2C2F SIG is to develop and continuously improve upon a guide that provides the following:

• A high-level solution-agnostic set of practices
• A detailed list of requirements
• A list of real-world supply chain threats specific to OSS, and how our Framework requirements mitigates them
• A maturity model-based implementation guide, with links to tools from across the industry
• A process for assessing your organization’s maturity
• A mapping of the Framework requirements to 6 other supply chain specifications

View or Download the S2C2F Specification

⭐: Click here for the PDF of the specification

: Click here to view the specification in markdown

Get Involved

• Official communications occur on the [email protected].
  Manage your subscriptions to Open SSF mailing lists.
• S2C2F SIG Slack
• Supply Chain Integrity WG Slack

Quick Start

• Areas that need contributions
• Build information if applicable
• Where to file issues
• Etc.

Meeting times

• Every other Tuesday @ 12:00pm PST The invite is available on the OpenSSF Community Calendar
• Meeting Minutes

Governance

[TODO: Update this link to your specific CHARTER.md file] The CHARTER.md outlines the scope and governance of our group activities.

• Lead: Adrian Diglio (https://github.com/adriandiglio)
• Co-Lead: Jay White (https://github.com/camaleon2016)

SIG Maintainers

• Jay White, Microsoft
• Adrian Diglio, Microsoft
• Jasmine Wang, Microsoft

SIG Collaborators

• Christopher "CRob" Robinson, Intel
• David A Wheeler, LF/OSSF