Page History

...

We already have policies around releases including creation of hashes and signing, https://www.apache.org/legal/release-policy.html#release-signing. Recently Infra wrote a tool to (download-integrity-checker) to validate that all our hosted download artifacts meet that policy.   Future However this need further development; see

...

ASF produces releases in the form of source materials.  However "convenience" compiled versions may also be distributed https://www.apache.org/legal/release-policy.html#compiled-packages but as this becomes more common, along with container and other distributions, we need a better policy around builds, more infra to allow projects to do builds on ASF controlled infrastructure, etc.  See for example

Related to this are dependencies. We do sometimes include these in source distributions but it becomes more of an issue when they're in builds, containers etc too.  Figure out some dependency tracking stuff, such as SLSA (then we'd end up with formulas for builds as well as dependency tracking) https://slsa.dev/provenance/v0.2

Fuzzing and Security Tool Services

What services are useful that we can provide as a service to all our projects.  We did a pilot and rejected SRC:CLR, but there are others worth looking at (for example OSS-Fuzz).  This would be a selection of pilots of tools.

SBOM

See SBOM

Some projects are starting to get requests to provide SBOM. But there are different formats and different advice. This project would look at the existing SBOM advice for open source, work on pilots with some projects, leading to recommendations for the final ASF advice to our projects, possible tooling, etc.

...