1 year ago

Dublin, Ireland — At https://thenewstack.io/open-source-summit-introducing-linux-foundation-europe/, the https://thenewstack.io/the-open-source-security-foundation-looks-to-unite-and-conquer/ announced that it had the funding needed to implement https://thenewstack.io/sbom-everywhere-the-openssf-plan-for-sboms/, its plan to bring https://thenewstack.io/securing-the-software-supply-chain-with-a-software-bill-of-materials/ to all programming languages and frameworks, into Python. The goal is to improve the resiliency and security of all open source software. Its first steps towards SBOM success came with funding work on the https://spdx.dev/ Python library.

What the SPDX python library didn’t have was volunteers with the right skills or funding to get the work done.

Just because the OpenSSF is paying for the code improvement doesn’t mean it will control the SPDX Python library.