Skip to content
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
Go to file
Cannot retrieve contributors at this time

Supply Chain Integrity WG


The objective of the Supply Chain Integrity Working Group (WG) is to provide a global community for collaborating to help individuals and organizations assess and improve the security of end-to-end supply chains for open source software.


Supply chain issues and attacks cause significant damage worldwide including lost revenue, costs of ransomware payments, costs of mitigation, denial of access to resources, reduced customer trust, and public deception. As a matter of public trust, governments are beginning to mandate actions aimed at improving the security and integrity of supply chains. The US White House Executive Order on Improving the Nation’s Cybersecurity is one such example.


We have a public email list available here:

See Google Groups for past archive:!forum/ossf-wg-developer-identity

You can also join our Slack channel at


The working group meets every other Wednesday at 9 AM Pacific. The public calendar is available here:

Subscribe to the calendar for meeting details.

Meeting Notes and Agendas are available on Google Drive. (Join the group listed under communications to edit.)


Documents for the working group can be found in the following Google Drive location:

Documents include the following:


Older activities (as Digital Identity Attestation WG):


This WG is chaired by Kim Lewandowski and Dan Lorenc

Working Group operations are consistent with standard operating guidelines provided by the OSSF Technical Advisory Committee TAC.

Full details of process and roles are linked from governance README.

Antitrust policy

Linux Foundation meetings involve participation by industry competitors, and it is the intention of the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws.

Examples of types of actions that are prohibited at Linux Foundation meetings and in connection with Linux Foundation activities are described in the Linux Foundation Antitrust Policy available at If you have questions about these matters, please contact your company counsel, or if you are a member of the Linux Foundation, feel free to contact Andrew Updegrove of the firm of Gesmer Updegrove LLP, which provides legal counsel to the Linux Foundation.