SOSS Community Day Europe 2024

There's an explosion of proprietary tools promising to resolve each and every software supply chain issue. But, none of these provide practical, reasonable, or affordable solutions to 1) massively improve the security posture of software teams and 2) comply with regulatory requirements. Software teams of all sizes continue to struggle navigating the complex network of tools and databases claiming to fix everything, especially with the explosion of reported CVEs and corresponding meltdown of processing these CVEs in the NVD. Open source tools are lagging and as an open source community, we can do better. In this talk, Philippe will present practical approaches to do something that works - using readily available OpenSSF projects, open source tools, and open data - to make compliance obtainable and automated with robust software supply chain security processes.