linux-foundation
Safeguard articles tagged "linux-foundation" — guides, analysis, and best practices for software supply chain and application security.
4 articles
Linux Foundation versus Apache Software Foundation: how governance shapes supply-chain risk
Both foundations host critical software, but they organize it very differently. The Linux Foundation's project-by-project incubation model and the ASF's uniform graduation process produce different risk profiles for the consumers downstream.
SPDX 3.0 AI Profile: Building an AIBOM in Practice
SPDX 3.0 was published in March 2025 with a dedicated AI profile and a Dataset profile. We walk through how to produce a defensible AIBOM in SPDX format alongside or in place of CycloneDX.
Open Source Foundation Governance Models
The Linux Foundation, Apache Software Foundation, CNCF, and Eclipse each codify different theories of how open source projects should be governed. The differences matter more than most adopters realize.
OpenSSF Alpha-Omega Project: Securing Open Source at Scale
The Alpha-Omega Project, backed by $5M from Google and Microsoft, aims to improve security of the most critical open source projects. Here's what it means for the ecosystem.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.