Google recently pledged $100 million to groups that manage open source security priorities and help fix vulnerabilities, and it has now detailed eight of the projects it has chosen to support.
Just last month the Linux Foundation announced it would directly fund people to work on the security of open-source projects. It’s got support from Google, Microsoft the Open Source Security Foundation and the Linux Foundation Public Health foundation. The Linux Foundation coordinates fixes when bugs are found.
The foundation and peers are looking for previously unknown security issues via security audits that will be undertaken by the Open Source Technology Improvement Fund (OSTIF). These projects include two Linux kernel security audits.
Now Google has thrown its weight behind a chunk of OSTIF’s immediate audit plans.
“Google’s support will allow OSTIF to launch the Managed Audit Program (MAP), which will expand in-depth security reviews to critical projects vital to the open source ecosystem,” said Kaylin Trychon, a security comms manager on the Google Open Source Security team.
Probably the biggest of the eight audit projects Google is funding is Git, the “de facto” version control software created by Linux kernel creator Linus Torvalds and which forms the basis of platforms like GitHub and GitLab.
“Git is the second-most critical application in C and the 10th-most critical application across all platforms,” OSTIF notes, adding that it is “undoubtedly one of the most critical pieces of open-source software in the world.”
“The eight libraries, frameworks and apps that were selected for this round are those that would benefit the most from security improvements and make the largest impact on the open-source ecosystem that relies on them,” explained Trychon.
The contribution from the Google will help OSTIF find and fix bugs in key open source projects.
OSTIF has identified a total of 25 MAP projects targeted for funding, including the eight that Google has funded to date. Other projects with funding pending support include well known systems and tools used by developers, such as the Drupal and Joomla web content management systems, webpack, reprepro, cephs, Facebook-maintained React Native, salt, Gatsby, Google-maintained Angular, Red Hat’s Ansible, and Google’s Guava Java framework.
After a meeting between US president Joe Biden and top US tech companies last month, Google announced a $10 billion commitment to improving expanding zero-trust programs, helping to secure software supply chains, and enhancing open-source security.