What security outcome are suppliers and consumers of open-source software seeking and why?

[sevansdell]

Does this capture the high level security outcome suppliers and consumers of open-source software seek?

"As a supplier and consumer of Open Source Software (OSS), I want to ensure the OSS I use is licensed and secure over it's lifecycle so that I can quickly and efficiently provide automated evidence to (and answer questions from) stakeholders regarding my products and services containing OSS".

Please see the following references: for how we define the supplier and consumer persona.

If you think the high level security outcome should be different, how would you reword it, and why?

This question is part of a special interest group in OpenSSF called the "Security Toolbelt". We are a part of the Best Practices Working Group, supported by the OpenSSF Technical Advisory Council (TAC).