OpenSSF Courses

Stop Peeing in the Pool - The Impact of Non-Compliant Licenses on Open Source

Explore the challenges of modern open source licensing, examining how non-compliant "faux-pen" licenses threaten ecosystem sustainability and deviate from core open source principles.

• YouTube
• 15 minutes
• Self-Paced
• Free Video

Project Copacetic - Directly Patch Container Image Vulnerabilities

Discover how to efficiently patch container image vulnerabilities with Project Copacetic, streamlining security updates through automated scanning, direct patching, and seamless pipeline integration.

• YouTube
• 20 minutes
• Self-Paced
• Free Video

Fortify Your Code: Secure Your Supply Chain with Scorecard

Discover how to assess and strengthen open-source software security using Scorecard, gaining practical insights into dependency risk management and implementing robust supply chain protection measures.

• YouTube
• 16 minutes
• Self-Paced
• Free Video

There Is Just One Way to Do Open Source Security - Together

Discover how collective efforts and unified approaches in open source security lead to superior results, exploring why fragmentation hinders progress and how collaboration drives innovation.

• YouTube
• 16 minutes
• Self-Paced
• Free Video

SLSA: A Security Paradigm for Software Supply Chain Integrity

Explore SLSA levels, software supply chain security basics, and tools like Cosign to enhance artifact integrity and benefit your organization.

• YouTube
• 58 minutes
• Self-Paced
• Free Video

Proactive Supply Chain Security with GUAC

Explore GUAC, a tool for proactive software supply chain security. Learn about its features, recent release, roadmap, and how to contribute to this OpenSSF project.

• YouTube
• 58 minutes
• Self-Paced
• Free Video

Improving Posture of Critical OSS Projects with Security Audits

Explore effective security audits for open source projects, including top vulnerabilities, lessons learned, and common mistakes to avoid. Enhance your OSS security posture.

• YouTube
• 22 minutes
• Self-Paced
• Free Video

Community Engagement and Security Initiatives: Examples from Python and Rust

Explore Python and Rust Foundations' security initiatives, focusing on community engagement, consensus building, transparent communication, and addressing pushback for better open-source security practices.

• YouTube
• 23 minutes
• Self-Paced
• Free Video

New Foundations of SBOM Are Underway at OpenSSF

Explore new OpenSSF projects addressing SBOM challenges, including protobom for data handling, sbomit for trust verification, and bomctl for basic operations. Learn about their impact on the SBOM ecosystem.

• YouTube
• 21 minutes
• Self-Paced
• Free Video

Securing the Software Supply Chain: An In-Depth Exploration of SLSA

Explore SLSA's impact on software supply chain security, covering fundamentals, trust, transparency, security levels, industry effects, and future trends.

• YouTube
• 59 minutes
• Self-Paced
• Free Video

Exploring the Large Language Models Open-Source Security Landscape

Explore security risks of Large Language Models, analyze their open-source ecosystem, and learn mitigation strategies. Gain insights from a comparative study of popular LLM projects' security postures.

• YouTube
• 34 minutes
• Self-Paced
• Free Video

Trusted Publishing: Lessons from PyPI

Explore PyPI's trusted publishing scheme, its OpenID Connect-based authentication, and implementation details. Learn about security improvements and potential applications for other package indices.

• YouTube
• 24 minutes
• Self-Paced
• Free Video

A Balancing Act: Collaboratively Developing Security in Open Source

Explore challenges and opportunities in developing open-source security, balancing collaborative practices with rigorous security measures across ecosystems and organizations.

• YouTube
• 20 minutes
• Self-Paced
• Free Video

OSV and the Life of an Open Source Vulnerability

Explore OSV's role in simplifying open source vulnerability management throughout the software development lifecycle, from database creation to guided remediation.

• YouTube
• 24 minutes
• Self-Paced
• Free Video

Intel's Experiences Using OpenSSF Scorecard to Better Secure Software Portfolio

Explore Intel's use of OpenSSF Scorecard to assess and mitigate software risks across their vast portfolio, learning from their experiences and challenges.

• YouTube
• 26 minutes
• Self-Paced
• Free Video