openSSF program

[fcollonval]

Hey dear security team,

I was made aware of the OpenSSF program in the course of Google Summer of Code. There are two actions I'm trying to set up for JupyterLab:

• OpenSSF scorecard
• OpenSSF best practices badge

I'm sharing the knowledge as it can help improving our security practices.

[fcollonval]

FYI I opened the following PR on JupyterLab: jupyterlab/jupyterlab#16012

[rpwagner]

@fcollonval this is a great suggestion, I'll make a comment here and then a similar one over in the JupyterLab repo.

In addition to the badge, the OpenSSF Best Practices Working Group maintains a set of guides, including the Concise Guide for Developing More Secure Software. One of the simplest things we could do is to adopt the practices in the Concise Guide that apply to Project Jupyter Subprojects. We wouldn't be able to do that right away, but it would give us a direction and a way to track our progress.

Also, OpenSSF is part of the Linux Foundation, so this has adoption by a wider open source community and may help if Project Jupyter does transition to the LF.