kimsterv
Joined 18 years ago
Karma
64
Submissions
6
Member since
Oct 7
Recent submissions
Comment · 4 years ago
Def check out the gitsign project mentioned in the post: https://github.com/sigstore/gitsign
Comment · 5 years ago
Honk! I represent Google on the OpenSSF, and help lead our Google Open Source Security Team. We've kicked off several projects inside the OpenSSF, and contribute to several other related efforts.
Here's a non-exhaustive list: Security Scorecards (https://github.com/ossf/scorecard): auto-generated security checks for OSS, Criticality Score (https://github.com/ossf/criticality_score): auto-generated criticality score for OSS, Package Feeds (https://github.com/ossf/package-feeds): watches package registries for updates, malware analysis tools, SLSA (https://github.com/slsa-framework/slsa): proposal for a supply chain integrity framework, Sigstore/Cosign (https://sigstore.dev/): code signing made easy!
We are also investing and exploring different efforts for improving security of critical OSS projects, and making it sustainable! If any of these projects sound interesting, come join us in the OpenSSF Working Groups!
*edited formatting
Comment · 5 years ago
Unfortunately, the openssf members haven’t come to consensus on the process for handling funding requests and the process. We’ll get there (hopefully!) but it’s looking like it’s going to take more time.
-Sincerely, Google’s OpenSSF governing board rep
Comment · 5 years ago
Dan’s the best. We work together, and we’re hiring. I’m biased but I think we have the most fun at Google. :)
Comment · 6 years ago
there's an open issue related to this:
https://github.com/ossf/scorecard/issues/27