By Stacey Potter
At OpenSSF, securing the open source software supply chain isn’t just about writing code or establishing policies. It is about growing the community of developers who build, maintain, and innovate these tools.
In our recent OpenSSF Welcome Call: Summer Mentorship Lightning Showcase, mentors and mentees gathered to demo the fruits of their summer collaboration. From securing repository signing keys to building human-readable visualizers for complex cryptographic chains, this year’s cohort demonstrated how fresh perspectives directly enhance ecosystem security.
Here is a look at what our mentees accomplished, what they learned along the way, and where these critical projects are heading.
Expanding Repository Security: Role-Specific Online Keys in RSTUF
In the Repository Service for TUF (RSTUF) ecosystem, managing trust and signing capabilities at scale is crucial. Mentee Amay Dixit (an undergraduate at IIT Bhilai) worked alongside mentors Srinjoy Dutta and Kairo de Araujo to address a major challenge in repository key management: scoping down key compromise impact.
Historically, an RSTUF deployment could use a shared global online signing key for repository metadata, including delegated metadata for projects hosted in the repository. For a multi-project repository, this meant that a compromise of the shared key could potentially affect the metadata of multiple projects.
Amay developed functionality enabling role-specific signing keys for succinct hash bin delegations and added commands to update existing delegations. Now, individual project delegations can sign their own release metadata with their own keys without the repository ever needing to hold the private half. If an individual project key is leaked, the blast radius is isolated strictly to that project, keeping the rest of the repository completely safe.
“The version that survived the review from my mentors is simpler and much closer to the actual deliverables… Tests tell you the pieces are correct, but they don’t tell you the whole system works until you run it end-to-end.”
— Amay Dixit, OpenSSF Mentee
Demystifying Cryptography: The RSTUF Metadata Visualizer
While security frameworks like The Update Framework (TUF) provide robust protection, reading raw JSON metadata filled with base64 signatures and cryptographic key IDs can be daunting for repository operators.
To solve this, mentees Yashasvi Yadav and Diya Sharma teamed up with mentor Srinjoy Dutta to build the RSTUF Metadata Visualizer – a dedicated web interface that runs natively inside an RSTUF deployment.
Key highlights of their work include:
- Security-First Architecture: Rather than parsing raw JSON from an unverified database, the backend leverages `python-tuf` to validate the entire cryptographic trust chain from the trusted root before displaying it.
- At-a-Glance Repository Health: Operators can immediately see the status, expiration countdowns, and signers for `root`, `timestamp`, `snapshot`, and `targets` roles.
- Delegation Graph & Artifacts Panel: Displays delegation hierarchies as an interactive tree graph and allows admins to inspect artifact file hashes and download verified raw metadata directly.
“The subtitle of our project is the entire pitch: ‘Making Cryptographic Metadata Actually Readable for Humans.’ When you open raw files, it’s hard to answer a simple question like, ‘Is the repository currently valid?’ The visualizer answers that instantly.”
— Diya Sharma, OpenSSF Mentee
Looking ahead, the long-term goal is to expand the visualizer beyond a read-only dashboard into a complete administrative tool capable of initiating signing ceremonies, releasing artifacts, and eventually serving as an intuitive web alternative to the CLI.
Streamlining Version Control Security: Enhancing Developer UX in gittuf
While repositories rely heavily on cryptographic signatures and access controls, getting developers to adopt security tools depends heavily on user experience. gittuf – a project that layers security policies directly on top of Git repositories – addresses this challenge by bringing The Update Framework (TUF) security models into developer version control workflows.
Mentee Kazuhide “Tony” Lee (a master’s student at NYU) and co-mentee Aarav Anand (a CS student at Polaris School of Technology), guided by maintainer Patrick Zielinski, focused their mentorship on making gittuf more approachable and intuitive.
Historically, gittuf has been a heavily CLI-driven tool. While CLI workflows suit experienced security engineers, inspecting branch policies, authorization rules, and commit signatures through terminal commands can present a steep learning curve for new users.
Key deliverables from Tony and Aarav’s work include:
- Terminal User Interface (TUI) Enhancements: Upgrading gittuf’s terminal interface to allow developers to interactively view repository policies, review authorization chains, and inspect delegation states without memorizing complex CLI flags.
- Visualizing Security Policies: Building upon visualizer capabilities from previous mentorship cohorts to map out who is authorized to make specific changes to a codebase, making security rules visible and transparent.
- Reducing Adoption Friction: Translating security rule evaluations into clean, visual feedback so development teams can verify policy compliance directly in their existing Git environment.
“gittuf adds vital security policies on top of Git, but tools only work if developers actually enjoy using them. Focusing on terminal interfaces and visual feedback helps bridge the gap between strong security models and day-to-day developer productivity.”
— Kazuhide “Tony” Lee, OpenSSF Mentee
Automating Security Enforcement at Scale: Testing Minder Rules
Beyond cryptographic signatures and repository visualization, supply chain security requires continuous policy enforcement across development platforms like GitHub and GitLab. That’s where Minder – an open source security posture management tool – comes in.
Mentee Krrish Biswas presented his work on Minder, focusing on streamlining how maintainers write, evaluate, and enforce security policies across repositories.
Key accomplishments from Krrish’s mentorship include:
- Testing & Extensibility: Adding key integration test suites to ensure Minder rules execute smoothly across large-scale repository organizations without breaking existing CI/CD pipelines.
- Developer Workflows: Krrish built a GitHub Action for automated testing, making it easier for repository admins to define security rules as code and automatically verify the rule correctness on change. Separately, the txtar format makes it easier to store “harmful” file-content such as vulnerable package manifests) safely in a repository for rule-testing purposes.
- Rule & Profile Enhancements: The testing work enabled rule authors to validate complex rules that involve multiple API endpoints or reason about both the repository state and API settings. Previously, writing and debugging these rules required a live system and sometimes server-side access for debugging.
“Minder gives maintainers peace of mind by turning complex security policies into automated checks. Working on Minder taught me how critical it is to build security tools that fit seamlessly into a developer’s existing daily workflow.”
— Krrish Biswas, OpenSSF Mentee
Strengthening Software Supply Chain Visibility with SBOMit
While Software Bills of Materials (SBOMs) are essential for supply chain security, standard dependency lists rarely capture the full picture of what software executes. SBOMit addresses this by combining standard software inventories with in-toto Witness attestations to deliver complete, execution-aware supply chain visibility.
During the LFX mentorship, Jaydeep Pokhariya worked on SBOMit under the guidance of Professor Justin Cappos and John Kjell, alongside contributors from the NYU Secure Systems Lab and collaborators at Purdue University. Key support came from Marco De Vincenzi, a postdoctoral researcher at NYU, Sanchit Sahay, a PhD student, Santiago Torres and Abhishek Reddypalle from Purdue. Their feedback encouraged Jaydeep to move beyond functional coding toward evaluating why specific designs belong in the project and how they integrate into the broader system.
Key accomplishments include:
- Strengthened the attestation infrastructure behind SBOMit: Contributed multiple improvements to go-witness, including fixing tracing cleanup across child processes, improving error handling and test reliability, supporting Linux architectures without architecture specific ptrace helpers, and resolving issues in Archivista and Fulcio integrations. These contributions strengthened the reliability and portability of the attestation pipeline on which SBOMit depends.
- Expanded SBOMit into a more capable and developer friendly SBOM generation tool: Added native Trivy cataloger support alongside Syft, enabling Trivy generated SPDX SBOMs to be parsed and enriched with attestation derived information. Also implemented path filtering, human readable generation and enrichment summaries, and improved package matching and deduplication so attestation metadata can enrich existing catalog data without unnecessarily introducing duplicate packages.
- Helped move SBOMit toward reusable ecosystem integration: Contributed to the ongoing effort to expose SBOMit functionality through a reusable library and prototype its capabilities within the Trivy/Syft ecosystem. Alongside this work, contributed improvements to JavaScript dependency resolution across npm, Yarn, and pnpm, metadata preservation during package deduplication, dynamic SBOMit versioning, and end-to-end integration testing, while learning to iterate through real world maintainer review and collaborative open source development.
“I came into the mentorship to learn how systems work; I left having learned how real open source engineering works.”
— Jaydeep Pokhariya, OpenSSF Mentee
Lessons Learned: Advice for Future Mentees & Contributors
During the showcase Q&A, mentees shared key insights for future contributors entering the open source security space:
- Read the Spec Before the Code: Source code can be overwhelming. Reading specification documents first provides the high-level context that makes code architecture instantly clearer.
- Communicate Early & Iterate Often: Don’t wait until a solution is completely built to ask for feedback. Early architectural chats with mentors prevent rework and produce simpler, more robust code.
- Embrace Code Reviews: Design improves dramatically when challenged by experienced maintainers. The review process is where the real learning happens.
Thank you to Mentorship Program Leads & Community Contributors:
- Srinjoy Dutta (RSTUF Mentor)
- Amay Dixit (RSTUF mentee)
- Yashasvi Yadav (RSTUF mentee)
- Diya Sharma (RSTUF mentee)
- Patrick Zielinski (gittuf Mentor)
- Kazuhide “Tony” Lee (gittuf mentee)
- Aarav Anand (gittuf mentee)
- Evan Anderson (Minder Mentor)
- Krrish Biswas (Minder mentee)
- Justin Cappos (SBOMit Mentor)
- John Kjell (SBOMit Mentor)
- Jaydeep Pokhariya (SBOMit mentee)
- Ejiro Oghenekome (BEAR WG Interim Lead)
- Sal Kimmich (BEAR WG Interim Lead)
- Marcela Melara (BEAR WG Lead)
- Yesenia Yser (BEAR WG Lead)
—
Get Involved with OpenSSF
The work presented during the Summer Mentorship Showcase is proof of what happens when experienced open source maintainers dedicate time to guiding the next generation of security developers. But that doesn’t only happen during the summer mentorship program, it happens every day in the OpenSSF Community.
- Want to participate?
- Check out the OpenSSF.org/getinvolved page
- Keep an eye on the LFX Mentorship platform for upcoming cohort announcements.
- Want to contribute to these and other projects?
- Check out the repositories:
- Check out our full list of OpenSSF Projects to see what might interest you!
If you’d like to watch the mentees presenting their work, you can view the BEAR Working Group’s OpenSSF Welcome Call: Summer Mentorship Lightning Showcase video and slides from each presentation:
About the Author
Stacey Potter is the Community Manager at OpenSSF, and brings extensive experience in open source community building, marketing, and event coordination. With a background spanning projects like Minder, Flux and Flagger, OpenFeature, and Keptn, she has played a key role in fostering engagement and driving adoption across cloud-native and open source security ecosystems.