OpenSSF Community Day Japan 2025

A year ago, with input from projects across different foundations, we set on a mission to delineate a minimum set of security requirements that could realistically be implemented by open source projects. No matter their size.

Thus, the Open Source Project Security Baseline was born.

With the Baseline maturing rapidly, it's time to check and enforce its requirements! For the Baseline to provide true security, cryptographically secure evidence has to be produced by projects that can, in turn, be tied to commits and built software artifacts.

Enter attestations!

By leveraging the In-Toto attestation framework and the Sigstore transparency log, this talk will show how to achieve unforgeable OSPS Baseline compliance through attested evidence that can securely be associated with repos, binaries, and container images.

It all sounds harder than it is. The talk will feature practical ways of achieving high compliance levels with only a handful of attestations from the OpenSSF family of tools, showing alternatives for each requirement.

The talk will conclude with an enforcement example, gating on build and deployment processes when repos and artifacts are not Baseline compliant.