The OpenSSF Working Group on Securing Software Repos is a collaborative forum that brings together maintainers of software repositories, registries, and related tools across different ecosystems to address shared security challenges.
The working group addresses fragmentation in how different package ecosystems handle security by creating a space for cross-ecosystem knowledge sharing and coordination. Rather than imposing solutions, it enables maintainers to exchange experiences, align policies, and identify common infrastructure needs. The group produces non-binding recommendations, best practices documentation, and security frameworks that individual ecosystems can adopt at their own pace.
This is appropriate for maintainers of package repositories, registries, or tools that depend on them who want to benchmark their security practices against peers and learn from solutions implemented elsewhere. It suits organizations managing language-specific registries, container systems, plugin ecosystems, or other software distribution channels. The working group explicitly avoids dictating technologies or creating binding obligations, instead offering guidance that members can evaluate and adapt to their context.
The working group has published concrete deliverables including a security maturity model for assessing repository capabilities, guidance on adopting trusted publishers and build provenance across registries, recommendations for package deletion policies, and a landscape survey documenting security mechanisms across different ecosystems. Development activity shows sustained engagement with regular publication of guidance documents addressing emerging needs in repository security, alongside ongoing coordination work to identify problems suitable for delegation to specialized subgroups.
