OSTIF published the results of a supply-chain security review and improvement effort for Scala 3, funded by the Sovereign Tech Agency after OSTIF spent more than a year advocating alongside the Scala project for a security maintenance program and a backer for supply-chain work. Supply-chain expert Adolfo Veytia worked directly with Scala security engineers to harden the release process: GitHub Actions are pinned to exact commit hashes instead of movable version tags, workflows run with least privilege and secrets scoped to the jobs that use them, long-lived credentials have been replaced with short-lived ones, and review and branch-protection requirements are recorded as signed attestations that can be checked later rather than taken on trust. OSTIF notes how difficult it remains to find money for open source security maintenance.
OSTIF publishes Scala 3 supply-chain security review
OSTIF published the results of a supply-chain security review and improvement effort for Scala 3, funded by the Sovereign Tech Agency after OSTIF spent more than a year advocating alongside the Scala project for a security maintenance program and a backer for supply-chain work. Supply-chain expert Adolfo Veytia worked directly with Scala security engineers to harden the release process: GitHub Actions are pinned to exact commit hashes instead of movable version tags, workflows run with least privilege and secrets scoped to the jobs that use them, long-lived credentials have been replaced with short-lived ones, and review and branch-protection requirements are recorded as signed attestations that can be checked later rather than taken on trust. OSTIF notes how difficult it remains to find money for open source security maintenance.
Source: Ostif