Tidelift Blog

There is so much going on in the world of SBOM that seems so wrong-headed to me, and this is a good example. So much of the effort seems to be going into processes and systems that do little more than build a chain of trust back to someone or something that says "yeah just trust me". Here, from what I can tell (and I may have got this wrong), the "guarantee" of an un-tamperable build seems to come from some behaviour that some product (GitHub Actions) happens to exhibit. Today. That feature subtly changes tomorrow or someone finds a(nother) hole in GitHub Actions security model, it means nothing.

I've generally come to believe that supply chain security comes from reproducible builds - though, more importantly, the build transparency that enables those builds to be performed reproducibly. If I can get two disparate, differently-hosted build machines to generate an identical artifact for me, that gives me far more confidence than relying on any behaviours that GitHub Actions is supposed to have. If I can then decide to ignore the pre-built package and choose to very easily perform the full scratch-build on my own systems and inspect every part of that process, that's even more convincing.

A lot of the efforts around SBOM give me the impression that they're trying to solve the problem using lightly-digitized bureaucracy (which, as pointed out by Luis Villa in https://blog.tidelift.com/pay-to-play-dont-expect-maintainers-to-solve-your-supply-chain-issues-for-free is a game…

Redis from Redis Labs, available under a choice of its own license or the SSPL, is pretty close to truly open-source, IMO closer to it than the BUSL, which is another source-available license. It is pretty similar to the AGPLv3, and they even credibly applied to get it OSI-approved.

https://blog.tidelift.com/what-i-learned-from-the-server-side-public-license https://opensource.stackexchange.com/questions/11291/how-to-interpret-the-sspl-terms-on-licensing-the-service-under-sspl

What it isn't close to is the original license, which is a permissive open source license.

The license switch-up is why a fork was needed. Matrix did a similar thing with the AGPL which alas, doesn't have a major fork. https://element.io/blog/element-to-adopt-agplv3/ Although it's technically still open source, they didn't do right by the contributors to it.

Just wanted to add here for those interested in this kind of thing, that we have over 4000 packages with income maintainers can claim today on Tidelift.

If you're a maintainer, ctrl-f through this list and see if you're in there: https://blog.tidelift.com/is-your-package-eligible-for-income-on-tidelift-heres-the-complete-list-may-2019

Tidelift is also supported via the new GitHub Sponsors feature:
https://tidelift.com/subscription/how-to-connect-tidelift-with-github

If you aren't in the 4000+ packages we have income for now, you can still sign up (which helps us get to subscribers who are specifically using your stuff, meaning income in the future).