cloudparts

Open Source Security Foundation

The Linux Foundation’s home for open-source security work, formed in 2020: it hosts Sigstore, SLSA, Scorecard and OpenBao, and runs working groups on supply chains, vulnerabilities and package repositories.

2 projects in this catalogPart of the Linux Foundation1 graduated1 sandboxWebsite

What it is

The Open Source Security Foundation (OpenSSF) is part of the non-profit Linux Foundation. It was announced on August 3, 2020 by merging two earlier efforts: the Linux Foundation’s Core Infrastructure Initiative, set up after the Heartbleed bug in 2014, and the Open Source Security Coalition that GitHub had founded in 2019. GitHub, Google, IBM, JPMorgan Chase, Microsoft, NCC Group, the OWASP Foundation and Red Hat sat on its first Governing Board. Most of what it hosts is not infrastructure to run but tools, specifications and guidance for securing other software: Sigstore for signing releases, SLSA for describing how a build was made, Scorecard for rating a repository’s security practices, the OSV schema for vulnerability data and the Best Practices badge. Since June 2025 it has also hosted OpenBao, the open-source fork of HashiCorp Vault.

Work is organised in working groups, such as Supply Chain Integrity, Securing Software Repositories and Vulnerability Disclosures, and every project reports to one of them. The Governing Board, made up of paying members, manages the budget; a nine-member Technical Advisory Council (TAC), six elected by the community and three appointed by the board, sets technical strategy and approves projects and stage changes. Money came in rounds tied to government attention: $10 million of new commitments in October 2021, and in May 2022 a ten-point mobilisation plan costed at about $150 million over two years, with more than $30 million pledged at the start.

For someone choosing technology, the badge means the project’s name sits with the Linux Foundation and the TAC has checked it against a lifecycle that leans on the OpenSSF’s own Best Practices badge: Silver to reach Incubating, Gold to graduate. Graduation also needs five maintainers from three organisations and, where it applies, a third-party security audit. In October 2026 the projects page lists 29 projects: three Graduated (the Best Practices Badge, Sigstore and SLSA), five Incubating (including GUAC, gittuf and Scorecard), 17 in the Sandbox, among them OpenBao, and four with no stage.

Its projects in this catalog

Graduated1

Projects with at least five maintainers from three organisations, a steady release cadence, a third-party security audit where it applies and a Gold OpenSSF Best Practices badge.

SigstoreOpen sourceSigning for releases, images and packages without keys to manage: a short-lived certificate tied to a login or CI job, and a public log of every signature.

Sandbox1

The entry stage for experiments: one maintainer, a sponsor from an OpenSSF working group and a repository under the OpenSSF’s GitHub; such projects may not call themselves an “OpenSSF Project” or use its logo.

OpenBaoOpen sourceThe open-source fork of HashiCorp Vault, kept under the MPL after Vault’s 2023 licence change: the same API, bao instead of vault, and namespaces without an enterprise licence.

In depth

What a sandbox badge does and doesn’t say#

The bar for the Sandbox is low on purpose: one maintainer, a sponsor from a working group, a fit with the mission and the code moved to the OpenSSF’s GitHub. The foundation is strict about the name in return. A sandbox project may describe itself as “a sandbox project in the OpenSSF”, but not as an “OpenSSF Project”, and it may not use the OpenSSF logo.

So a sandbox badge says a project has a neutral home, not that it is mature. OpenBao is a sandbox project although it shipped a stable 2.0 in 2024 and builds on Vault code dating back to 2015; Sigstore graduated in March 2024, three years after it launched. Projects that go quiet can be archived: candidates are sandbox projects dormant for six months and incubating or graduated ones dormant for nine, and archiving takes a two-thirds vote of the TAC or the parent working group.

Who decides#

The TAC approves every new project and every change of stage. For Incubating and Graduated, the sponsoring working group carries out technical due diligence and recommends, and the proposal is open for two weeks of public comment before the TAC votes. The working group advises a project and settles technical disputes, but the lifecycle document is explicit that it “does not set the charter or operations” of the project, which keeps its own maintainers and governance.

In October 2026 the TAC’s chair is Zach Steindler of GitHub and its vice chair Bob Callaway of Google; the other seats are held by people from IBM, Kusari, Microsoft, Chainguard, Bloomberg, Ericsson and DeployHub. The foundation says membership level has no influence on project decisions.

Where it came from2014–2025

After the Heartbleed bug in OpenSSL in 2014, the Linux Foundation set up the Core Infrastructure Initiative to support critical open-source projects. In 2019 GitHub started a separate Open Source Security Coalition. On August 3, 2020 the Linux Foundation folded both into the OpenSSF, with Jim Zemlin calling open source security “one of the most important things we can do”.

Attention from governments followed. In October 2021 the foundation announced $10 million in new commitments and appointed Brian Behlendorf as general manager. After the White House’s National Security Council led a first open source security summit on January 13, 2022, the OpenSSF and the Linux Foundation published a ten-point mobilisation plan in May, costed at about $150 million over two years.

Its projects have matured since. Sigstore, launched by the Linux Foundation in 2021, graduated in March 2024. In June 2025 OpenBao moved over from LF Edge, its chair saying the OpenSSF matched its contributors and mission better.

Why it’s built this way

Merge existing efforts instead of starting again
The Core Infrastructure Initiative, GitHub’s coalition and work by the founding members all addressed open-source security; combining them gave members one place to fund it and one set of working groups.
Projects report to working groups
A working group such as Supply Chain Integrity sponsors each project, advises it and checks it before promotion, which ties tools such as Sigstore and SLSA to the problem they are meant to solve.
Use its own Best Practices badge as the bar
The lifecycle asks for the Silver badge to incubate and the Gold badge to graduate, so the foundation holds its projects to the same checklist it asks other projects to meet.

Timeline

  1. 2014

    The Linux Foundation sets up the Core Infrastructure Initiative after Heartbleed

  2. 2019

    GitHub founds the Open Source Security Coalition

  3. 2020

    OpenSSF announced on August 3, merging the two

  4. 2021

    $10 million in new commitments; Brian Behlendorf becomes general manager in October

  5. 2022

    Ten-point mobilisation plan, costed at about $150 million, published in May

  6. 2024

    Sigstore graduates in March

  7. 2025

    OpenBao joins from LF Edge as a sandbox project in June

Sources · facts checked 2026-10-28

Improve this page on GitHub