The number of Free/Libre and Open Source Software (FLOSS) projects increases every year. The developers community aims at delivering high-quality software with comprehensive documentation, test coverage, and high level of security. To coordinate the efforts towards these goals, a dedicated organization has been created, called Open Source Security Foundation (OpenSSF).

Respected IT companies contributed to the OpenSSF security best practices and to the software for security analysis of open source projects [1]. Representative deliverables include:

•    OpenSSF Best Practices badge

•    Secure Software Development Fundamentals courses

•    Security Scorecards

•    Criticality Score

•    Security metrics dashboard

•    OpenSSF CVE Benchmark

•    OWASP Security Knowledge Framework (SKF)

•    Report on the 2020 FOSS Contributor Survey

The baseline component is the OpenSSF Best Practices badge project [2] which is included into OpenSSF.

Figure 1.  Some badge earners

Currently there are over 4800 projects excercising OpenSSF Best Practices [3].

The OpenSSF Best Practices badge is a way for open source projects to show that they follow the best practices of mature software development. OpenSSF Best Practices badge allows 3rd-party developers to quickly evaluate project maturity. Such projects are less likely to introduce security issues in case of re-use. They also help the authors of evaluated project to identify potential improvement areas. OpenSSF Best Practices badge indicates that the open source project follows security best practices to ensure resilience against known and future security issues.

To receive OpenSSF Best Practices badge the project has to pass evaluation according to a well-defined standardized evaluation methodology. There are three levels of badges: "passing", "silver" and "gold". Each level requires an open source project to meet a set of criteria. For "silver" and "gold", this includes reaching the previous level. The "passing" level has 67 criteria, "silver" – 55, and "gold" – another 23. All evaluation criteria are categorized into five groups: Basics, Change Control, Quality, Security and Analysis.

OpenSSF provides Scorecard software to automate GitHub open source projects self-evaluation. Evaluation metrics include: well-defined security policies, code review process, continuous testing coverage, fuzzing, and static code analysis [4]. The following checks are run against the target project by default: Binary-Artifacts, Branch-Protection, CI-Tests, CII-Best-Practices, Code-Review, Contributors, Dangerous-Workflow, Dependency-Update-Tool, Fuzzing, License, Maintained, Pinned-Dependencies, Packaging, SAST, Security-Policy, Signed-Releases, Token-Permissions, Vulnerabilities [5].

Figure 2.  Home Edge architecture

Home Edge is an open source project, hosted by LF Edge, that aims at enabling a robust, reliable, and intelligent home edge computing. It provides an open source framework, platform, and ecosystem to execute various scenarios on a variety of smart home IoT devices. To successfully accelerate the edge computing services ecosystem's deployment, the Home Edge project provides users with an interoperable, flexible, and scalable edge computing service platform and a set of APIs.