Collection

Tag: software-supply-chain

OpenSSF and the Push to Treat Open-Source Security as Shared Infrastructure

OpenSSF brought companies, projects, and security initiatives together around the idea that vulnerabilities and supply-chain risks in widely reused open source are ecosystem problems requiring shared tools and investment.

↗

When Code Became a Supply Chain: Dependencies, Packages, and Trust

Package managers and reusable dependencies made software development faster, but they also turned code into a supply chain whose trust extends through maintainers, build systems, registries, and transitive components.

↗