standard
Body that released model-signing tooling 1.0 in spring 2025 and later formalized the OpenSSF Model Signing specification.
No evidence-backed relationships are recorded.
Trusted publishing swaps a stored npm token for a short-lived OIDC one, and it needs npm CLI 11.5.1, Node 22.14.0 and a hosted runner. The CLI falls back to the old token whenever the OIDC path is absent.
Reality
The engineer running Dependabot across 30 million repositories says wiring in OpenSSF's malicious-package feed was the cheap part, while normalization ate the budget and each alert ends in a build-credential incident.
Reality
HiddenLayer's revenue grew more than tenfold last year selling security for models, while the new money funds a coding-agent module announced on the same day, which makes this a round priced on next year's budget line.
Reality
The Linux Foundation's coalition for AI-generated vulnerability reports starts taking automated submissions next month. Its membership terms set the ceiling on what it can absorb.
Reality
Hugging Face counts 28,531 community GGUF conversions of Alibaba's Qwen models against 54 from Alibaba itself. Procurement signs for the model; production loads the artifact.
Reality