# openssf

Published articles for openssf.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## How OSPOs Are Preparing Organizations for the EU Cyber Resilience Act

DevFeed: [How OSPOs Are Preparing Organizations for the EU Cyber Resilience Act](<https://devfeed.tech/articles/how-ospos-are-preparing-organizations-for-the-eu-cyber-resilience-act-14497.md>)

Original publisher: [Read original article](<https://www.linuxfoundation.org/blog/how-ospos-are-preparing-organizations-for-the-eu-cyber-resilience-act>)

Author: andrewb@proximabiz.com (The Linux Foundation)

Published: 2026-09-09T19:11:24Z

Content type: article

Language: en

Sources: [Linux Foundation - Blog](<https://devfeed.tech/sources/linux-foundation-blog.md>)

Topics: [cyber resilience act](<https://devfeed.tech/topics/cyber-resilience-act.md>), [Security](<https://devfeed.tech/topics/security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [open-source-security](<https://devfeed.tech/topics/open-source-security.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [cyber-resilience-act](<https://devfeed.tech/tags/cyber-resilience-act.md>), [eu](<https://devfeed.tech/tags/eu.md>), [linux-foundation](<https://devfeed.tech/tags/linux-foundation.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [openssf](<https://devfeed.tech/tags/openssf.md>), [regulatory](<https://devfeed.tech/tags/regulatory.md>), [security](<https://devfeed.tech/tags/security.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

### AI overview

This Linux Foundation post explains how Open Source Program Offices can help organizations prepare for the EU Cyber Resilience Act, including identifying affected products and dependencies, coordinating legal, security, engineering and procurement teams, and responding to vulnerability and incident reporting obligations.

### Source excerpt

For organizations offering products with digital elements in the EU, the next major Cyber Resilience Act (CRA) deadline arrives on 11 September 2026. From that date, organizations covered by the reporting obligations must be ready to assess actively exploited vulnerabilities and severe security incidents, coordinate an internal response and submit notifications within the required timelines.

## From Campus to Community Part 3: What Universities Uniquely Bring

DevFeed: [From Campus to Community Part 3: What Universities Uniquely Bring](<https://devfeed.tech/articles/from-campus-to-community-part-3-what-universities-uniquely-bring-14495.md>)

Original publisher: [Read original article](<https://www.linuxfoundation.org/blog/from-campus-to-community-part-3-what-universities-uniquely-bring>)

Author: Nithya Ruff

Published: 2026-07-21T14:14:34Z

Content type: opinion

Language: en

Sources: [Linux Foundation - Blog](<https://devfeed.tech/sources/linux-foundation-blog.md>)

Topics: [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [ai safety](<https://devfeed.tech/topics/ai-safety.md>), [Responsibility & Safety](<https://devfeed.tech/topics/responsibility-safety.md>), [LLM evaluation / benchmarking](<https://devfeed.tech/topics/llm-evaluation-benchmarking.md>), [openssf](<https://devfeed.tech/topics/openssf.md>), [linux foundation](<https://devfeed.tech/topics/linux-foundation.md>), [Nvidia](<https://devfeed.tech/topics/nvidia.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [ai-safety](<https://devfeed.tech/tags/ai-safety.md>), [benchmarking](<https://devfeed.tech/tags/benchmarking.md>), [evaluation](<https://devfeed.tech/tags/evaluation.md>), [nvidia](<https://devfeed.tech/tags/nvidia.md>), [openssf](<https://devfeed.tech/tags/openssf.md>), [policy](<https://devfeed.tech/tags/policy.md>), [security](<https://devfeed.tech/tags/security.md>)

### AI overview

This opinion article argues that universities have a distinctive role in shaping safe and fair AI through independent benchmarking, adversarial evaluation, governance standards, and longer-term research. It describes ongoing debates over open AI models and cites Linux Foundation initiatives and related communities.

### Source excerpt

This is a series from Linux Foundation Board Chair, Nithya Ruff. Read Part One and Two.

## AI-driven zero-day combinations are challenging software security and open-source consumption

DevFeed: [AI-driven zero-day combinations are challenging software security and open-source consumption](<https://devfeed.tech/articles/the-hardest-fork-13253.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/the-hardest-fork>)

Published: 2026-05-28T00:00:00Z

Content type: opinion

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [open-source-security](<https://devfeed.tech/topics/open-source-security.md>), [Security](<https://devfeed.tech/topics/security.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Machine Learning, Security Attacks](<https://devfeed.tech/topics/machine-learning-security-attacks.md>), [Critical Infrastructure](<https://devfeed.tech/topics/critical-infrastructure.md>), [openssf](<https://devfeed.tech/topics/openssf.md>), [sigstore](<https://devfeed.tech/topics/sigstore.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [anthropic-mythos](<https://devfeed.tech/tags/anthropic-mythos.md>), [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [critical-infrastructure](<https://devfeed.tech/tags/critical-infrastructure.md>), [fork](<https://devfeed.tech/tags/fork.md>), [mfa](<https://devfeed.tech/tags/mfa.md>), [mythos](<https://devfeed.tech/tags/mythos.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [openssf](<https://devfeed.tech/tags/openssf.md>), [oss](<https://devfeed.tech/tags/oss.md>), [project-glasswing](<https://devfeed.tech/tags/project-glasswing.md>), [rust](<https://devfeed.tech/tags/rust.md>), [sast](<https://devfeed.tech/tags/sast.md>), [secure-open-source](<https://devfeed.tech/tags/secure-open-source.md>), [security](<https://devfeed.tech/tags/security.md>), [sigstore](<https://devfeed.tech/tags/sigstore.md>)

### AI overview

The article argues that Mythos represents a potential new class of software-security threat: AI-driven combinations of existing issues that can produce more serious attacks than individual scanner findings. It discusses the limits of government regulation and calls for stronger trust infrastructure, coordinated disclosure, and safer open-source consumption.

### Source excerpt

Mythos is changing software security fast. AI-driven zero-days demand new trust infrastructure, coordinated disclosure, and secure open source consumption.

## This Shit is Hard: Hardening glibc

DevFeed: [This Shit is Hard: Hardening glibc](<https://devfeed.tech/articles/this-shit-is-hard-hardening-glibc-13281.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/this-shit-is-hard-hardening-glibc>)

Published: 2025-08-20T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Compiler](<https://devfeed.tech/topics/compiler.md>), [gcc](<https://devfeed.tech/topics/gcc.md>), [toolchain](<https://devfeed.tech/topics/toolchain.md>), [chainguard](<https://devfeed.tech/topics/chainguard.md>), [chainguard packages](<https://devfeed.tech/topics/chainguard-packages.md>), [C](<https://devfeed.tech/topics/c.md>), [Linux](<https://devfeed.tech/topics/linux.md>)

Tags: [c](<https://devfeed.tech/tags/c.md>), [c-c-plus-plus](<https://devfeed.tech/tags/c-c-plus-plus.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [chainguard-security](<https://devfeed.tech/tags/chainguard-security.md>), [compiler](<https://devfeed.tech/tags/compiler.md>), [compiler-flags](<https://devfeed.tech/tags/compiler-flags.md>), [gcc](<https://devfeed.tech/tags/gcc.md>), [glibc](<https://devfeed.tech/tags/glibc.md>), [hardening](<https://devfeed.tech/tags/hardening.md>), [openssf](<https://devfeed.tech/tags/openssf.md>), [security](<https://devfeed.tech/tags/security.md>), [toolchain](<https://devfeed.tech/tags/toolchain.md>)

### AI overview

Chainguard describes its effort to build glibc with hardened compiler flags. The work involved collaboration with the upstream GCC and glibc projects to resolve complex issues and ship a hardened version of the library.

### Source excerpt

Chainguard uses compiler flags to be proactive in the security of our products. See how our compiler flag usage helped us catch a complex bug in glibc.

## Enhanced Compiler Flags for Building Chainguard's Guarded Images

DevFeed: [Enhanced Compiler Flags for Building Chainguard's Guarded Images](<https://devfeed.tech/articles/enhanced-compiler-flags-for-building-chainguard-s-guarded-images-13030.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/enhanced-compiler-flags-for-building-chainguards-guarded-images>)

Published: 2024-11-19T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard images](<https://devfeed.tech/topics/chainguard-images.md>), [c/c++](<https://devfeed.tech/topics/c-c-plus-plus.md>), [Security](<https://devfeed.tech/topics/security.md>), [Compiler](<https://devfeed.tech/topics/compiler.md>), [Memory Safety](<https://devfeed.tech/topics/memory-safety.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>)

Tags: [c-plus-plus](<https://devfeed.tech/tags/c-plus-plus.md>), [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [compiler](<https://devfeed.tech/tags/compiler.md>), [compiler-flags](<https://devfeed.tech/tags/compiler-flags.md>), [compiler-hardening](<https://devfeed.tech/tags/compiler-hardening.md>), [memory-safety](<https://devfeed.tech/tags/memory-safety.md>), [openssf](<https://devfeed.tech/tags/openssf.md>), [secure-by-default](<https://devfeed.tech/tags/secure-by-default.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

### AI overview

Chainguard Images now use enhanced compiler flags for C/C++ projects. The OpenSSF-recommended hardening is implemented through clang configuration files and gcc spec files in Wolfi, helping mitigate memory-safety vulnerabilities such as stack-based buffer overflows and unsafe memory usage.

### Source excerpt

Chainguard Images are now built using enhanced compiler flags for C/C++ projects. See how this strengthens the security posture of Chainguard's build systems.

## Wolfi's upstream security inspection: Scanning with OpenSSF Scorecard

DevFeed: [Wolfi's upstream security inspection: Scanning with OpenSSF Scorecard](<https://devfeed.tech/articles/wolfi-s-upstream-security-inspection-scanning-with-openssf-scorecard-13340.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/wolfis-upstream-security-inspection-scanning-with-openssf-scorecard>)

Published: 2024-08-02T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [open-source-security](<https://devfeed.tech/topics/open-source-security.md>), [Security](<https://devfeed.tech/topics/security.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [openssf](<https://devfeed.tech/topics/openssf.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [Maintainers](<https://devfeed.tech/topics/maintainers.md>)

Tags: [chainguard-labs](<https://devfeed.tech/tags/chainguard-labs.md>), [github](<https://devfeed.tech/tags/github.md>), [maintainers](<https://devfeed.tech/tags/maintainers.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [openssf](<https://devfeed.tech/tags/openssf.md>), [research](<https://devfeed.tech/tags/research.md>), [security](<https://devfeed.tech/tags/security.md>), [wolfi](<https://devfeed.tech/tags/wolfi.md>)

### AI overview

Chainguard Labs evaluated the security of 1,511 upstream Wolfi repositories using the OpenSSF Scorecard. The mean score was 5.4 out of 10; repositories associated with Ruby and C packages had lower average scores of 4.8 and 4.7, respectively.

### Source excerpt

Chainguard Labs analyzed the security of 1,500+ upstream Wolfi repositories using the OpenSSF Scorecard tool -- uncover the key findings in the latest research.

## Chainguard enhances security with OSV advisory feed

DevFeed: [Chainguard enhances security with OSV advisory feed](<https://devfeed.tech/articles/chainguard-enhances-security-with-osv-advisory-feed-12943.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguard-enhances-security-with-osv-advisory-feed>)

Published: 2024-07-02T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard](<https://devfeed.tech/topics/chainguard.md>), [vulnerability management](<https://devfeed.tech/topics/vulnerability-management.md>), [open-source-security](<https://devfeed.tech/topics/open-source-security.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Maintainers](<https://devfeed.tech/topics/maintainers.md>), [chainguard images](<https://devfeed.tech/topics/chainguard-images.md>), [data](<https://devfeed.tech/topics/data.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Google](<https://devfeed.tech/topics/google.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [google](<https://devfeed.tech/tags/google.md>), [maintainers](<https://devfeed.tech/tags/maintainers.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [open-source-vulnerabilities](<https://devfeed.tech/tags/open-source-vulnerabilities.md>), [openssf](<https://devfeed.tech/tags/openssf.md>), [osv](<https://devfeed.tech/tags/osv.md>), [secure-open-source](<https://devfeed.tech/tags/secure-open-source.md>), [secure-software](<https://devfeed.tech/tags/secure-software.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [vulnerability-data](<https://devfeed.tech/tags/vulnerability-data.md>), [vulnerability-management](<https://devfeed.tech/tags/vulnerability-management.md>), [wolfi](<https://devfeed.tech/tags/wolfi.md>)

### AI overview

Chainguard is publishing its security advisory feed in the OSV format, improving the precision and usability of vulnerability information for open source maintainers and downstream consumers.

### Source excerpt

Explore Chainguard's new OSV advisory feed, delivering comprehensive and up-to-date vulnerability information to enhance your security posture.

## Grype Adds OpenVEX Support for Vulnerability Analysis

DevFeed: [Grype Adds OpenVEX Support for Vulnerability Analysis](<https://devfeed.tech/articles/vexed-then-grype-about-it-chainguard-and-anchore-announce-grype-supports-openvex-13311.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/vexed-then-grype-about-it-chainguard-and-anchore-announce-grype-supports-openvex>)

Published: 2023-10-10T00:00:00Z

Content type: tutorial

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [grype](<https://devfeed.tech/topics/grype.md>), [openvex](<https://devfeed.tech/topics/openvex.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [vulnerability management](<https://devfeed.tech/topics/vulnerability-management.md>), [anchore](<https://devfeed.tech/topics/anchore.md>), [chainguard](<https://devfeed.tech/topics/chainguard.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [anchore](<https://devfeed.tech/tags/anchore.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cybersecurity-and-infrastructure-security-agency](<https://devfeed.tech/tags/cybersecurity-and-infrastructure-security-agency.md>), [grype](<https://devfeed.tech/tags/grype.md>), [openssf](<https://devfeed.tech/tags/openssf.md>), [openvex](<https://devfeed.tech/tags/openvex.md>), [scanner](<https://devfeed.tech/tags/scanner.md>), [security](<https://devfeed.tech/tags/security.md>), [software-bill-of-materials](<https://devfeed.tech/tags/software-bill-of-materials.md>), [software-supply-chain-security](<https://devfeed.tech/tags/software-supply-chain-security.md>), [vex](<https://devfeed.tech/tags/vex.md>), [vulnerability-management](<https://devfeed.tech/tags/vulnerability-management.md>), [vulnerability-scanner](<https://devfeed.tech/tags/vulnerability-scanner.md>)

### AI overview

Grype, Anchore's open-source vulnerability scanner, now supports OpenVEX, a machine-readable standard for vulnerability analysis. The article explains how this can provide context for vulnerabilities and help reduce false positives and vulnerability-management effort.

### Source excerpt

Open source vulnerability scanner Grype has added support for OpenVEX, making software supply chain security easier. Learn how to implement it today.

## Priorities from the OpenSSF Secure Open Source Software Summit 2023

DevFeed: [Priorities from the OpenSSF Secure Open Source Software Summit 2023](<https://devfeed.tech/articles/priorities-from-the-openssf-secure-open-source-software-summit-2023-8041.md>)

Original publisher: [Read original article](<https://snyk.io/blog/openssf-secure-open-source-software-summit-2023/>)

Author: Dan Appelquist

Published: 2023-10-04T15:00:00Z

Content type: article

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [open-source-security](<https://devfeed.tech/topics/open-source-security.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Security](<https://devfeed.tech/topics/security.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [GitLab](<https://devfeed.tech/topics/gitlab.md>), [Incident response](<https://devfeed.tech/topics/incident-response.md>), [Maintainers](<https://devfeed.tech/topics/maintainers.md>)

Tags: [awareness](<https://devfeed.tech/tags/awareness.md>), [best-practices](<https://devfeed.tech/tags/best-practices.md>), [blog](<https://devfeed.tech/tags/blog.md>), [collaboration](<https://devfeed.tech/tags/collaboration.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [github](<https://devfeed.tech/tags/github.md>), [gitlab](<https://devfeed.tech/tags/gitlab.md>), [government](<https://devfeed.tech/tags/government.md>), [incident-response](<https://devfeed.tech/tags/incident-response.md>), [maintainers](<https://devfeed.tech/tags/maintainers.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [openssf](<https://devfeed.tech/tags/openssf.md>), [scm](<https://devfeed.tech/tags/scm.md>), [secure-open-source](<https://devfeed.tech/tags/secure-open-source.md>), [security](<https://devfeed.tech/tags/security.md>), [snyk-open-source](<https://devfeed.tech/tags/snyk-open-source.md>), [summit](<https://devfeed.tech/tags/summit.md>), [workflows](<https://devfeed.tech/tags/workflows.md>)

### AI overview

The OpenSSF Secure Open Source Software Summit 2023 identified priorities for improving open source security, including maintainer education, repository security, and cross-industry incident response. Snyk describes a Source Code Management Best Practices Guide for GitHub and GitLab repositories, used with OpenSSF Scorecard to improve permissions, workflows, policies, and security practices.

### Source excerpt

A recent summit meeting convened by the OpenSSF with the White House brought together various US Government departments for a chat about open source security.

## OSS security: Chainguard May 2023 update

DevFeed: [OSS security: Chainguard May 2023 update](<https://devfeed.tech/articles/oss-security-chainguard-may-2023-update-13198.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/oss-security-chainguard-may-2023-update>)

Published: 2023-05-22T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [open-source-security](<https://devfeed.tech/topics/open-source-security.md>), [chainguard](<https://devfeed.tech/topics/chainguard.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [openssf](<https://devfeed.tech/tags/openssf.md>), [oss](<https://devfeed.tech/tags/oss.md>), [security](<https://devfeed.tech/tags/security.md>), [slsa](<https://devfeed.tech/tags/slsa.md>), [wolfi](<https://devfeed.tech/tags/wolfi.md>)

### AI overview

Chainguard's May 2023 update recaps open-source software security community activity, including talks and events, work on the Kubernetes 1.27 release, and the announcement of SLSA 1.0.

### Source excerpt

Read the latest announcements in open source software security this spring including SLSA 1.0, Sigstore + npm, OpenVEX had its kickoff meeting, and more!

## Meet Chainguard at Open Source Summit North America 2023 \[May 10 - 12 in Vancouver\]!

DevFeed: [Meet Chainguard at Open Source Summit North America 2023 \[May 10 - 12 in Vancouver\]!](<https://devfeed.tech/articles/meet-chainguard-at-open-source-summit-north-america-2023-may-10-12-in-vancouver-13151.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/meet-chainguard-at-open-source-summit-north-america-2023-may-10-12-in-vancouver>)

Published: 2023-05-05T00:00:00Z

Content type: news

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Open Source](<https://devfeed.tech/topics/open-source.md>), [chainguard](<https://devfeed.tech/topics/chainguard.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [open-source-summit](<https://devfeed.tech/tags/open-source-summit.md>), [openssf](<https://devfeed.tech/tags/openssf.md>)

### AI overview

Chainguard announces its participation in Open Source Summit North America 2023 in Vancouver, including talks and sessions on software supply chain security, SBOMs, Sigstore, Gitsign, and SPDX 3.0 tooling.

### Source excerpt

Chainguard will be at OSSummit NA May 8-12 in Vancouver. Check out our talks and sessions and connect to learn about OSS projects like Wolfi, Sigstore and more.

## OSS Security: Chainguard Spring 2023 update

DevFeed: [OSS Security: Chainguard Spring 2023 update](<https://devfeed.tech/articles/oss-security-chainguard-spring-2023-update-13199.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/oss-security-chainguard-spring-2023-update>)

Published: 2023-03-22T00:00:00Z

Content type: release

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard](<https://devfeed.tech/topics/chainguard.md>), [open-source-security](<https://devfeed.tech/topics/open-source-security.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Security](<https://devfeed.tech/topics/security.md>), [software bill of materials](<https://devfeed.tech/topics/software-bill-of-materials.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [cloud-native](<https://devfeed.tech/tags/cloud-native.md>), [cloud-native-security-con](<https://devfeed.tech/tags/cloud-native-security-con.md>), [fosdem](<https://devfeed.tech/tags/fosdem.md>), [foss](<https://devfeed.tech/tags/foss.md>), [gitops](<https://devfeed.tech/tags/gitops.md>), [kubecon-eu](<https://devfeed.tech/tags/kubecon-eu.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [open-source-software](<https://devfeed.tech/tags/open-source-software.md>), [open-source-software-security](<https://devfeed.tech/tags/open-source-software-security.md>), [openssf](<https://devfeed.tech/tags/openssf.md>), [oss](<https://devfeed.tech/tags/oss.md>), [sigstore](<https://devfeed.tech/tags/sigstore.md>), [software-bill-of-materials](<https://devfeed.tech/tags/software-bill-of-materials.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>)

### AI overview

Chainguard's Spring 2023 update describes its involvement in open-source software security during the first part of 2023. It covers community leadership, conference talks and workshops, software freedom advocacy, and efforts to make software bills of materials useful and widely adopted for supply-chain security.

### Source excerpt

Chainguard believes open source is important and we mean it. Check out how we've been involved in OSS Security in the first part of 2023.

## New SLSA++ Survey reveals real-world developer approaches to software supply chain security

DevFeed: [New SLSA++ Survey reveals real-world developer approaches to software supply chain security](<https://devfeed.tech/articles/new-slsa-survey-reveals-real-world-developer-approaches-to-software-supply-chain-security-13183.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/new-slsa-survey-reveals-real-world-developer-approaches-to-software-supply-chain-security>)

Published: 2023-03-15T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [open-source-security](<https://devfeed.tech/topics/open-source-security.md>), [Security](<https://devfeed.tech/topics/security.md>), [openssf](<https://devfeed.tech/topics/openssf.md>)

Tags: [best-practices](<https://devfeed.tech/tags/best-practices.md>), [developer](<https://devfeed.tech/tags/developer.md>), [devops](<https://devfeed.tech/tags/devops.md>), [digital-signatures](<https://devfeed.tech/tags/digital-signatures.md>), [integrity](<https://devfeed.tech/tags/integrity.md>), [maintainers](<https://devfeed.tech/tags/maintainers.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [openssf](<https://devfeed.tech/tags/openssf.md>), [report](<https://devfeed.tech/tags/report.md>), [rust](<https://devfeed.tech/tags/rust.md>), [secure-software-development-frameworks](<https://devfeed.tech/tags/secure-software-development-frameworks.md>), [security](<https://devfeed.tech/tags/security.md>), [security-best-practices](<https://devfeed.tech/tags/security-best-practices.md>), [slsa](<https://devfeed.tech/tags/slsa.md>), [software-development](<https://devfeed.tech/tags/software-development.md>), [software-security-practices](<https://devfeed.tech/tags/software-security-practices.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [software-supply-chain-security](<https://devfeed.tech/tags/software-supply-chain-security.md>), [supply-chain-integrity](<https://devfeed.tech/tags/supply-chain-integrity.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>), [survey](<https://devfeed.tech/tags/survey.md>)

### AI overview

A joint survey by Chainguard, the Eclipse Foundation, the Rust Foundation, and OpenSSF examined how developers, open source maintainers, and security practitioners adopt software supply chain security practices. Among nearly 170 respondents, centralized build services showed relatively strong adoption, while consistently signing built artifacts was less common, with 25% reporting that their team always did so. Respondents generally considered the surveyed practices helpful.

### Source excerpt

Findings on software supply chain security practice adoption from our joint survey with OpenSSF, Rust, and Eclipse with questions derived from SLSA requirements.

## GoReleaser v1 -- one year later

DevFeed: [GoReleaser v1 -- one year later](<https://devfeed.tech/articles/goreleaser-v1-one-year-later-37765.md>)

Original publisher: [Read original article](<https://carlosbecker.com/posts/goreleaser-v1-1year/>)

Author: Carlos Alexandro Becker

Published: 2022-11-14T00:00:00Z

Content type: article

Language: en

Sources: [Carlos Becker](<https://devfeed.tech/sources/carlos-becker.md>)

Topics: [releases](<https://devfeed.tech/topics/releases.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [Maintainers](<https://devfeed.tech/topics/maintainers.md>), [Security](<https://devfeed.tech/topics/security.md>), [sigstore](<https://devfeed.tech/topics/sigstore.md>), [anchore](<https://devfeed.tech/topics/anchore.md>), [openssf](<https://devfeed.tech/topics/openssf.md>)

Tags: [anchore](<https://devfeed.tech/tags/anchore.md>), [github](<https://devfeed.tech/tags/github.md>), [maintainers](<https://devfeed.tech/tags/maintainers.md>), [openssf](<https://devfeed.tech/tags/openssf.md>), [release](<https://devfeed.tech/tags/release.md>), [releases](<https://devfeed.tech/tags/releases.md>), [security](<https://devfeed.tech/tags/security.md>), [sigstore](<https://devfeed.tech/tags/sigstore.md>)

### AI overview

A retrospective on GoReleaser's first year after version 1.0.0, covering its development activity, release cadence, community growth, new features, bug fixes, integrations, and progress on security and supply-chain practices.

### Source excerpt

We launched GoReleaser v1 exactly 1 year ago today!