Landscape
How OpenVet relates to existing supply-chain auditing and dependency-security tools in the broader landscape.
Supply-chain security tooling and products have taken off in the past few years. There is a variety of tools, standards and commercial enterprise offerings. This section locates OpenVet relative to other systems readers may know, covering what each tool or product does and how OpenVet relates to it.
By relationship to OpenVet #
Auditing tools. These tools allow you to audit software, publish those audits in some ways, and ingest those audits.
Provenance attestation. These tools do not help with auditing code, but they provide attestations that help you answer where a specific artifact comes from. These are useful to establish the provenance of binary assets, but they make no claim over if the artifact is free of malware, only where it came from.
Dependency scanners. These tools help you assess the risk of dependencies based on heuristics, and surface known vulnerabilities.
Curated software package repositories. These are software repositories, often commercial, that provide a curated set of dependencies. Often they come with build provenance attestations, and sometimes with some human review of the published versions.
Take-aways #
OpenVet focusses on helping you audit software, publish those audits, ingest those audits and evaluate requirements on them. As such, it is an auditing tool, and competes directly with the other tools listed.
OpenVet differs in the data model it uses, the trust model it uses, the cryptographic guarantees it provides, the distribution model, and in the ecosystems it works with.
Auditing is meaningful on source-based packages. Auditing binary packages cannot be done in any meaningful way. Where you need to use binary packages, provenance attestation can help you. Audits of packages with binary assets generally cannot express whether the binary asset is safe, but can verify the provenance. The downside is that it requires the maintainer to use provenance attestation.
Dependency scanners looking for known vulnerabilities are reactive, rather than proactive. OpenVet is intended as a replacement for them, by re-publishing known vulnerabilities in the Audit data model. Dependency scanners that evaluate risk based on heuristics can be used alongside OpenVet for dependencies that you have not audited. They don’t replace actually reading the code, and usually cannot make statements about the quality and correctness of the code, but they are a stop-gap solution.
Curated software package repositories can be used alongside OpenVet. OpenVet focuses on auditing dependencies your code uses directly, not external systems it interacts with.