公共部门软件供应链白皮书

PUBLIC SECTORSOFTWARESUPPLY CHAIN Authors Reviewers Christopher Robinson (OpenSSF Chief Architect)Joel Krooswyk (GitLab Federal CTO)Jordan KasperZach Steindler (OpenSSF TAC, GitHub) Daniel Moch (Lockheed Martin)William Crum (Spectro Cloud)Ihor Dvoretskyi (Cloud Native Computing Foundation)Ian Dunbar-HallHari Kunduru (Applied Research Associates)Sean Bentley (Boeing) PUBLISHEDNOVEMBER 9, 2025 EXECUTIVE SUMMARY The software supply chain is a vital component of successful software development organizations. However,incidents such as the 2020 Solarwinds attack, the 2021 Log4J vulnerability (Log4Shell), the 2024 xz backdoor(CVE-2024-3094), and the 2025 “tj-actions/changed-files” supply chain attack (CVE-2025-30066) havedemonstrated how easily backdoors and breaches in the software supply chain can be exploited, impactingorganizations and individuals globally. The Log4J vulnerability, in particular, is notable due to its widespreaddeployment and the staggering 10 million exploitation attempts per hour reported just one month after itsdiscovery. Just one month after being discovered, the Wall Street Journal had identified a staggering 10 millionexploitation attempts per hour.1 Organizations that implement robust secure software supply chain tools and practices are able to respondfaster to such incidents, thanks to increased visibility and transparency. But a rising tide lifts all boats and asecure software supply chain would significantly mitigate the risk of such attacks by ensuring the integrityand authenticity of software dependencies from development to deployment, preventing malicious code orunauthorized modifications. The Cloud Native Public Sector User Group2was formed in 2023 to serve as a hub for discussing and advancingcloud computing within the public sector. Alongside enumerating current best practices, we are dedicatedto improving public sector workflows and supply chain security by advocating for the development andimplementation of secure and resilient cloud-native software found within the public sector. In this whitepaper, we aim to clearly address the current and future challenges of securing the public sectorsoftware supply chain, and propose long-term, sustainable solutions for using open source technologies to meetthe needs of government systems, whilst ensuring cost-effective solutions exist for the software supply chain. TABLE OF CONTENTS Executive Summary...........................................................................................02Table of Contents..............................................................................................03Problem Statement...........................................................................................04Audiences and Desired Outcomes....................................................................04Challenges in the Public Sector.........................................................................05Software Registries..........................................................................................05Supply Chain Reference Architecture................................................................06Establishing Trust.............................................................................................07Generating S3C Data.........................................................................................08Sharing S3C Data..............................................................................................09Verifying and AnalyzingS3C Data......................................................................10Technical Implementation...................................................................................12Adoption Roadmap............................................................................................13Conclusion........................................................................................................13Appendix..........................................................................................................14Endnotes.........................................................................................................14References.......................................................................................................14Glossary...........................................................................................................15 Problem Statement The CNCF Public Sector User Group would like to leverage secure software supply chain (S3C) tooling,developed in the broader software industry, to secure the software development lifecycle. We believe a practical solution will allow for leveraging the S3C work of conscientious open sourcemaintainers, be easy to adopt by governments, small business, and large entities alike, and enable trustand transparency between partners within the public sector. Furthermore, it should aid compliance withNIST standards and other international standards and guidelines (see “References” in th