Software Supply-Chain Security Reading List

A reading list for software supply-chain security.

Policy

Open Software Security Foundation (OpenSSF)
- Alpha-Omega Project: find and fix vulnerabilities in OSS, and improve project security
- Working groups
  - Identifying Security Threats in Open Source Projects
  - Best Practices for Open Source Developers
  - Securing Critical Projects
  - Security Tooling
  - Supply Chain Integrity
  - Vulnerability Disclosures
  - Securing Software Repositories
Cloud Native Computing Foundation (CNCF)
- Parent of TUF and in-toto (see above)
- Technical Advisory Group on Security (TAG security)
Continuous Delivery Foundation (CDF)
- Parent of Tekton (see above)
- Special Interest Group Software Supply Chain (SIG Software Supply Chain)
- Special Interest Group Best Practices (SIG Best Practices)