OpenSSF Courses

Under the Radar: How We Found 0-Days in the Build Pipeline of OSS Packages

Explore critical vulnerabilities in OSS build pipelines, including 0-day discoveries in major projects. Learn about attack trees, mitigations, and 'Living Off the Pipeline' components for enhanced security.

• YouTube
• 20 minutes
• On-Demand
• Free Video

Every Journey to Securing the Software Supply Chain Starts with a Single Step

Explore NYU's journey in software supply chain security, uncovering challenges, best practices, and a roadmap for enhancing software security.

• YouTube
• 13 minutes
• On-Demand
• Free Video

Embrace the Differences: Securing Open Source Ecosystems Where They Are

Explore efforts to fix the libwebp vulnerability in Python packages, examining interactions between security standards and open source ecosystems.

• YouTube
• 18 minutes
• On-Demand
• Free Video

Eating the Open Source Security Sandwich with Skootrs

Explore Skootrs, an open-source tool simplifying adoption of security practices for software developers through automation and guardrails.

• YouTube
• 19 minutes
• On-Demand
• Free Video

Build Provenance: Lessons from Homebrew

Explore build provenance for Homebrew package manager, including achievements, challenges, and technical insights. Learn about its architecture and implications for similar ecosystems.

• YouTube
• 16 minutes
• On-Demand
• Free Video

The Journey of the Node.js Permission Model

Explore the creation of Node.js Permission Model, uncovering motivations, challenges, and solutions. Gain insights into this experimental security feature and its impact on the ecosystem.

• YouTube
• 15 minutes
• On-Demand
• Free Video

Better Build Pipelines with OpenSSF Projects - Enhancing Trust and Security

Enhance build pipeline security using OpenSSF projects: cosign, SBOMs, and SLSA. Demonstrate kpack for container image building on Kubernetes, integrating signed images and SBOM generation.

• YouTube
• 14 minutes
• On-Demand
• Free Video

Collaborating Along the Software Supply Chain

Explore strategies for managing open source software supply chains, focusing on collaboration between projects, foundations, consumers, and government to ensure security and efficiency.

• YouTube
• 18 minutes
• On-Demand
• Free Video

A Beginner's View of Public Instances

Explore OpenSSF's public instances: hosting, scale, security, and usage guidelines. Gain insights into tools for safer software development and protection against attackers.

• YouTube
• 14 minutes
• On-Demand
• Free Video

Presenting the OSTIF Independent Security Audit Impact Report

Explore OSTIF's 2022 security improvements to critical open source projects, funded by OpenSSF. Learn about the initiative's background and key outcomes.

• YouTube
• 16 minutes
• On-Demand
• Free Video

Fuzzing Rekor for Bugs and Vulnerabilities

Explore fuzzing techniques for Rekor, Sigstore's transparency log. Learn about challenges, artifact types, and results from months of testing. Gain insights on third-party security research approaches.

• YouTube
• 12 minutes
• On-Demand
• Free Video

Hardening the DevOps Pipeline with New Open-Source Security Tooling

Explore 5 phases of DevOps pipeline security using open-source tools. Learn about code signing, repo scanning, image SBOMs, OCI registries, pipeline audits, and evidence catalogs to enhance cybersecurity.

• YouTube
• 17 minutes
• On-Demand
• Free Video

Getting Involved in Sigstore Research Projects

Explore Sigstore's research opportunities in privacy-conscious transparency, stronger verification assurances, and distributed trust timestamping. Learn how to contribute to this open-source project.

• YouTube
• 11 minutes
• On-Demand
• Free Video

Activities in Japan and 10 Streams of OSS Security Mobilization Plan

Explore Japan's OSS security activities, SBOM adoption challenges, and potential certification uses in cloud services. Gain insights into unique industry perspectives and future preparedness.

• YouTube
• 14 minutes
• On-Demand
• Free Video

Protecting Kubernetes Resource Manifests in End-to-End Software Development Lifecycle

Secure Kubernetes manifests throughout the software development lifecycle. Learn about integrity protection, signing techniques, and end-to-end supply chain security.

• YouTube
• 14 minutes
• On-Demand
• Free Video