Skip to main content
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [List Home]
Re: [eclipse.org-architecture-council] RFC: Eclipse Foundation Secure Software Supply Chain Levels
Thanks, Jens, for the feedback.

Our primary idea is to provide guidance and a clear path towards better security for projects. 

We don't intend to enforce any requirements. Instead, we believe a badging program that allows projects to demonstrate their achieved security levels is preferable. While this can be verified during reviews, we aim to, as much as possible, continuously reflect the project's security posture, not just during annual evaluations. We are building automation to help with that. OtterDog and its dashboard are part of this strategy.

Ideally, projects will be able to advertise these badges. Additionally, we want to map the practices outlined in our levels to other well-known frameworks like SLSA and SSDF, enabling projects to automatically highlight their compliance with these standards as well.

Cheers!

Mikaël Barbero 
Head of Security | Eclipse Foundation
Eclipse Foundation: The Community for Open Innovation and Collaboration



On 27 Jun 2024 at 14:51:50, Jens Reimann <jreimann@xxxxxxxxxx> wrote:
I think it makes perfect sense. What I didn't understand is: how that would be applied to projects?

Is that something that projects would self attest/certify? Is that something that would be enforced by the foundation? Or attested by the foundation during reviews? Resulting in some level of compliance projects can advertise with?

On Wed, Jun 26, 2024 at 10:29 PM Mikael Barbero via eclipse.org-architecture-council <eclipse.org-architecture-council@xxxxxxxxxxx> wrote:
Dear Architecture Council members,

This is a request for review and feedback on a new security framework proposal, Eclipse Foundation Secure Supply Chain Lifecycle (EF3SCL). EF3SCL is a pragmatic security framework designed to promote actionable security practices and provide a clear progression path for Eclipse Foundation projects to secure their supply chains.


The draft document for EF3SCL can be found here: https://github.com/eclipse-csi/gradually/blob/main/EF3SCL.md 


We have shared this framework with several other groups. To gather all feedback and allow for inter-group discussion, we have initiated a discussion thread on GitHub. In this thread, we provide context and reasoning behind the creation of this framework. We would greatly appreciate it if you could share your comments there.


We look forward to your valuable feedback and guidance.


Cheers,


Mikaël Barbero 
Head of Security | Eclipse Foundation
Eclipse Foundation: The Community for Open Innovation and Collaboration

_______________________________________________
eclipse.org-architecture-council mailing list
eclipse.org-architecture-council@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/eclipse.org-architecture-council


--
Jens Reimann
Principal Software Engineer / R&D Product Middleware
_____________________________________________________________________________

Red Hat GmbH, Registered seat: Werner-von-Siemens-Ring 12, D-85630 Grasbrunn, Germany
Commercial register: Amtsgericht München/Munich, HRB 153243,
Managing Directors: Ryan Barnhart, Charles Cachera, Michael O'Neill, Amy Ross

Back to the top