Publications

The documents of the OpenSSF ecosystem — specifications and frameworks like SLSA and the OSPS Baseline, and the formats that flow across the supply chain like SBOM, VEX, and SLSA Provenance. Each publication has its own page describing what it is and which projects produce, consume, or implement it.

Prefer to start elsewhere? Browse by project → or by role →

Gemara Whitepaper

"Gemara: A Governance, Risk, and Compliance Engineering Model for Automated Risk Assessment" — the whitepaper defining Gemara's layered model of governance, risk, and compliance activities and how they interoperate.

See how it connects

OSPS Baseline

The Open Source Project Security Baseline — a consensus-driven minimum set of security requirements for projects to adopt and for consumers to expect.

See how it connects

OSV Record (vulnerability record format)

aka OSV Record

The serialised vulnerability-record format produced by OSV-aligned databases (osv.dev, GHSA, PyPA, Go vuln DB) and consumed by vuln scanners and SCA tools. Distinct from the `osv-schema` project, which is the authoring effort defining the f…

See how it connects

OSV Schema & OpenVEX

Standard, machine-readable formats for describing vulnerabilities (OSV) and their exploitability status (OpenVEX) across the software supply chain.

See how it connects

SARIF

aka Static Analysis Results Interchange Format

An OASIS standard JSON format for representing static analysis tool results. Consumed by code-scanning UIs (e.g. GitHub Code Scanning) and produced by linters, scanners, and policy tools such as Scorecard.

See how it connects

SLSA

Supply-chain Levels for Software Artifacts — a framework of progressive security requirements for source, build, and provenance integrity.

See how it connects

SLSA Provenance

Cryptographically attested record of how a software artifact was built, including the build platform identity, source revision, build parameters, and the resulting artifact digest.

See how it connects

Security Insights

A machine-processable YAML specification that lets a project declare its security posture, vulnerability-handling process, and supporting resources.

See how it connects

Software Bill of Materials

aka SBOM

A machine-readable inventory of the components contained in a software artifact. Multiple authoritative formats exist (CycloneDX, SPDX); this record models the SBOM concept itself rather than any single format.

See how it connects

Vulnerability Exploitability eXchange

aka VEX

A machine-readable statement asserting whether a known vulnerability affects a given software artifact (and under what conditions). Pairs with SBOM and OSV records to reduce false-positive vuln signal.

See how it connects

in-toto Attestation

The signed-envelope format that SLSA Provenance and other supply-chain attestations ship in. Defines the predicate/statement structure and signature wrapper used by every conforming attestation.

See how it connects