Supply Chain Security (6)

• Open Source Security Foundation – Linux Foundation Projects (openssf.org) organisation
  Linux Foundation body coordinating OSS security best practices, free secure-coding courses and tooling
  Nonprofit Security Hardening #
• SPDX License List | Software Package Data Exchange (SPDX) (spdx.org) reference
  Canonical short identifiers, full texts and permanent URLs for licences found in code, data and hardware
  License Compliance Licensing #
• REUSE - Make licensing easy for everyone (reuse.software) reference
  FSFE three-step recipe for per-file copyright and SPDX headers, machine-checkable in CI
  License Compliance Licensing #
• BadgeApp (bestpractices.dev) tool
  Free self-certification app where FLOSS projects answer OpenSSF criteria to earn a passing badge
  Code Quality Web Application #
• Home (OpenSSF Scorecard) tool
  Automated repo checks (branch protection, pinned deps, signing) run as GitHub Action or CLI
  Code Quality Vulnerability #
• OSV - Open Source Vulnerabilities (osv.dev) dataset
  advisories keyed precisely to affected package versions and commits, aggregated from GHSA, PyPA, RustSec
  Package Manager Vulnerability #