It’s been an interesting few weeks in the open source software supply chain space. The recent XZ vulnerability and OpenJS social-engineering attempt represent a sea change in how malicious actors behave. These events mark a transition from opportunistic exploitation (of known CVEs) to active exploitation (creating backdoors in projects in the supply chain). With malicious attacks becoming more sophisticated—and AI making it easier and faster for attackers to execute them—we need new tools and approaches to detect and prevent supply chain attacks.
My co-founder, Luke Hinds, pioneered the open source sigstore project as one such approach. Sigstore makes it easier for developers to sign their software artifacts and produce a provenance statement, providing assurance to downstream consumers that the package is what it says it is, and hasn’t been altered by a bad actor. The npm package ecosystem and Homebrew now integrate with sigstore.
We founded Stacklok to help developers and open source communities use innovative open source tools like sigstore to secure their supply chains. So we’re excited today to announce the launch of two new capabilities that build on tools like sigstore to help detect and prevent supply chain attacks. Over time, we believe these capabilities will help mitigate newly emerging techniques that are threatening the health of open source ecosystems.
Introducing the OSS Trust Graph: Building a trust model for open source
"Who writes all this software? The who is a trust question. We need to start thinking and talking about this, and create systems that help maintainers, who are already over-worked, to trust each other. We need ways to make this easier for the community."
- Jim Zemlin, Executive Director, Linux Foundation
Open source software is built on trust. Because the goal of open source is to allow anyone to contribute, communities building OSS software—and the developers consuming it—must trust that contributors and maintainers are there to do good, not harm.
The challenge is that trustworthiness is hard to quantify. Why do we trust people? We trust them because we know them or someone who knows them, or because they can prove their trustworthiness through experience and social validation, like a degree from a nationally recognized university, or a restaurant with a Michelin star.
Conversely, we may lose trust when that person’s behavior or status changes—e.g., the university receives bad press, or the award-winning chef leaves the restaurant. No single signal can prove trustworthiness, but rather the sum total of information we know about someone.
In November 2023, Stacklok introduced Trusty, a free-to-use service by Stacklok that uses sigstore and statistical analysis to score open source packages on their supply chain risk, and help developers choose safer, more trustworthy dependencies. Today, we’re introducing the OSS Trust Graph, a new capability of Trusty, as a way to model trust in open source ecosystems. It maps the connections between open source contributors and projects, and, through our “proof-of-diligence” algorithm, uses that data to build an understanding of the relative safety and sustainability of those projects.
Above: An example of the OSS Trust Graph for an open source package in Trusty
Each contributor, package, and project repo in the OSS Trust Graph shown above has a “trust score.” These scores are based on Trusty’s supply chain risk data, as well as the behaviors and connections among contributors, packages, and repositories. For example, when a developer contributes to a high-quality project, they are not just adding code; they're influencing the project's value and quality, underscored by the project's acceptance of their contributions. When a developer with a track record of contributions to a well-known and well-supported project decides to engage with a less-known project, it indicates the developer's trust in the project's worth, demonstrated through their investment of time and expertise.
Our intent behind the OSS Trust Graph is twofold:
Identify malicious activity. We can’t say with confidence that the OSS Trust Graph would have uncovered the XZ vulnerability, but we believe it’s a step in the right direction. We know that the hostile actors’ introduction of many relatively unknown “sock puppet” accounts would have driven down the score of the project. While there would be a fair amount of activity, the introduction of relatively unknown individuals all contributing to the same project would lower the project’s score, providing a signal to the community.
Identify open source projects that need support. Through changes in scoring, the OSS Trust Graph could help us understand when high-contributing maintainers leave a high-scoring and widely used project, leaving it vulnerable to being abandoned or to a hostile takeover. Likewise, it could help identify high-scoring projects with a low number of high-scoring maintainers that could benefit from additional support and funding.
We’re making the OSS Trust Graph accessible today in private beta with a simple UI experience, and more significantly a reusable API. We believe it has potential to help make the open source ecosystem safer, but we need to ensure that it won’t be harmful to smaller open source communities, or create unintended behaviors. So we’re inviting community members to test this out and provide feedback, before we make this data broadly available for public good use.
Introducing Minder Cloud: Using community activity data to inform policies for open source use
Having high-quality intelligence about open source packages is only as useful as an organization’s or a community’s ability to drive policies that shape developer behavior. That’s why we launched the open source platform Minder last November, as a way to apply and continuously enforce policies across the software delivery lifecycle.
Today, we are launching Minder Cloud, a fully managed version of Minder that makes it easier for open source communities and project owners to set up and enforce policies to help them produce safer, more sustainable software. To that end, we have committed to making Minder Cloud free forever for use on public repositories.
Over time, we plan to introduce new policies that make use of the OSS Trust Graph scores to make it easier to, for example, automatically detect changes in project ownership, or changes in behavior from a regular contributor.
Above: An example of a managed policy template in Minder Cloud
Next steps
We believe that insight and controls around open source dependency decision making will be critical to sustainability of the communities that drive so much innovation in the software industry. As attackers become more sophisticated and have access to more sophisticated tools, we will need to come together and collaborate in an effort to drive sustainability over time.
We invite you to engage with us in the following ways:
