|
1 | 1 | # OpenSSF Securing Software Repositories Working Group
|
2 | 2 |
|
3 |
| -This is a list of materials (surveys, documents, proposals, and so on) released by the [OpenSSF Securing Software Repositories Working Group](https://github.com/ossf/wg-securing-software-repos). |
| 3 | +The motivation of the working group is to focus on helping maintainers of software repositories, software registries, and tools which rely on them. It is both a forum to share experiences and discuss shared problems (for more information, see [Communication](https://github.com/ossf/wg-securing-software-repos?tab=readme-ov-file#communication)) as well as a place to publish content to benefit package repositories. |
4 | 4 |
|
5 |
| -## Surveys |
| 5 | +## Maturity Model |
6 | 6 |
|
7 |
| -* [The Package Manager Landscape Survey](https://github.com/ossf/wg-securing-software-repos/blob/main/survey/2022/README.md) - December 2022 |
8 |
| - > A survey/landscape of different security mechanisms and features that are implemented across the different ecosystems as they pertain to security critical user journeys. |
| 7 | +* [Principles for Package Repository Security](https://repos.openssf.org/principles-for-package-repository-security) - February 2024 |
| 8 | + > A security maturity model for package repositories, for assessing current capabilities and roadmapping future improvements. |
9 | 9 |
|
10 |
| -## Documents |
| 10 | +## Implementation Guidance |
11 | 11 |
|
12 | 12 | * [Trusted Publishers for All Package Repositories](https://repos.openssf.org/trusted-publishers-for-all-package-repositories) - July 2024
|
13 | 13 | > Guidance for package repositories in adopting Trusted Publishers to authenticate publishing from hosted build environments without using long-lived credentials.
|
14 | 14 |
|
15 |
| -* [Principles for Package Repository Security](https://repos.openssf.org/principles-for-package-repository-security) - February 2024 |
16 |
| - > A security maturity model for package repositories, for assessing current capabilities and roadmapping future improvements. |
17 |
| -
|
18 | 15 | * [Build Provenance for All Package Registries](https://repos.openssf.org/build-provenance-for-all-package-registries) - July 2023
|
19 | 16 | > Guidance for package registries in adopting build provenance to verifiably link a package back to its source code and build instructions.
|
20 | 17 |
|
21 |
| -## Proposals |
| 18 | + |
| 19 | +## Proposals, Surveys, and Other Work |
22 | 20 |
|
23 | 21 | * [Build Provenance and Code-signing for Homebrew](https://repos.openssf.org/proposals/build-provenance-and-code-signing-for-homebrew) - July 2023
|
24 | 22 | > A proposal for introducing build provenance and cryptographic signatures to the Homebrew package manager.
|
| 23 | +This is a list of materials (surveys, documents, proposals, and so on) released by the [OpenSSF Securing Software Repositories Working Group](https://github.com/ossf/wg-securing-software-repos). |
| 24 | + |
| 25 | +* [The Package Manager Landscape Survey](https://github.com/ossf/wg-securing-software-repos/blob/main/survey/2022/README.md) - December 2022 |
| 26 | + > A survey/landscape of different security mechanisms and features that are implemented across the different ecosystems as they pertain to security critical user journeys. |
0 commit comments