Be heard! Join the AlmaLinux Foundation as a Member or Sponsor. Own and vote on shaping the future of AlmaLinux OS!
{{ i18n "Be heard!" }}{{ i18n "Join the" }} AlmaLinux Foundation {{ i18n "as a Member or Sponsor." }}{{ i18n "Own and vote on shaping the future of AlmaLinux OS!" }}
The AlmaLinux Foundation is the entity behind AlmaLinux OS, the forever-free Enterprise-grade Linux distribution. As a member, you will have a voice in the direction of the project, and can vote for and be voted into the Board of Directors by other members. There are several pathways available for becoming a member, including project contributors, mirror maintainers/sponsors and service providers to the community, as well as official sponsors for the project.
{{ i18n "The AlmaLinux Foundation is the entity behind AlmaLinux OS, the forever-free Enterprise-grade Linux distribution."}} {{ i18n "As a member, you will have a voice in the direction of the project, and can vote for and be voted into the Board of Directors by other members."}} {{ i18n "There are several pathways available for becoming a member, including project contributors, mirror maintainers/sponsors and service providers to the community, as well as official sponsors for the project." }}
</p>
<p>
The merit of each application will be reviewed on a case-by-case basis by the Board or by a committee appointed for this purpose, according to the <ahref="/p/foundation-bylaws/"class="al-laws-link"><b>Bylaws</b></a> established by the Board.
{{ i18n "The merit of each application will be reviewed on a case-by-case basis by the Board or by a committee appointed for this purpose, according to the" }}<ahref="/p/foundation-bylaws/"class="al-laws-link"><b>{{ i18n "Bylaws" }}</b></a>{{ i18n "established by the Board." }}
</p>
<p>
Membership guidelines are <ahref="https://drive.google.com/file/d/1Z73BBJ5_HY6nMUu3DxnPkFrlXYIpFaQ0/view"class="al-guideline-link"target="_blank"><b>available here</b></a>
Direct access to AlmaLinux executives and staff to help with consultation, planning, and engagement opportunities, including advance information on upcoming announcements and projects
{{ i18n "Direct access to AlmaLinux executives and staff to help with consultation, planning, and engagement opportunities, including advance information on upcoming announcements and projects" }}
</li>
</ul>
</td>
<td></td>
</tr>
<tr>
<td>Fees (Annual)</td>
<td>{{ i18n "Fees (Annual)" }}</td>
<td>$2,500</td>
<td>$20,000</td>
<td>$100,000</td>
</tr>
<tr>
<td>Alternative contribution</td>
<td>{{ i18n "Alternative contribution" }}</td>
<td>
per membership committee confirmation: Any contribution of hardware or services based on board approval
{{ i18n "per membership committee confirmation: Any contribution of hardware or services based on board approval" }
</td>
<td>per board of directors confirmation:
<td>{{ i18n "per board of directors confirmation:" }}
<ul>
<li>One dedicated FTE working on AlmaLinux</li>
or
<li>{{ i18n "One dedicated FTE working on AlmaLinux" }}</li>
{{ i18n "or" }}
<li>
annual service credits or hardware donation valued at $20,000 or more
{{ i18n "annual service credits or hardware donation valued at $20,000 or more" }}
</li>
</ul>
</td>
<td>
per board of directors confirmation:
{{ i18n "per board of directors confirmation:" }}
<ul>
<li>Three dedicated FTE working on AlmaLinux</li>
<li>{{ i18n "Three dedicated FTE working on AlmaLinux" }}</li>
An individual application for anyone who uses AlmaLinux OS, contributes to AlmaLinux OS, provides services to the AlmaLinux OS community or otherwise supports the AlmaLinux OS.
{{ i18n "An individual application for anyone who uses AlmaLinux OS, contributes to AlmaLinux OS, provides services to the AlmaLinux OS community or otherwise supports the AlmaLinux OS." }}
An individual or entity that provides the project with mirror(s) for content distribution. Only one member application per individual or entity will be accepted, irrespective of contributed number of mirrors.
{{ i18n "An individual or entity that provides the project with mirror(s) for content distribution." }}{{ i18n "Only one member application per individual or entity will be accepted, irrespective of contributed number of mirrors." }}
<h1class="al-section-title mb-3">AlmaLinux Software Bill of Materials (SBOM) Information</h1>
<h1class="al-section-title mb-3">{{ i18n "AlmaLinux Software Bill of Materials (SBOM) Information" }}</h1>
<article>
<divclass="al-article-content pb-5 al-wysiwyg">
<p>
AlmaLinux provides a Software Bill of Materials (SBOM) for its releases.
{{ i18n "AlmaLinux provides a Software Bill of Materials (SBOM) for its releases." }}
</p>
<h2>What is an SBOM?</h2>
<h2>{{ i18n "What is an SBOM?" }}</h2>
<p>
SBOM, which stands for Software Bill of Materials, is something akin to an “ingredient list” for a
codebase. It helps identify the contents of software, including what open source and third-party
components are used, licensing information, components' versions and if there are any known
vulnerabilities in those components.
{{ i18n "SBOM, which stands for Software Bill of Materials, is something akin to an “ingredient list” for a codebase." }}
{{ i18n "It helps identify the contents of software, including what open source and third-party components are used, licensing information, components' versions and if there are any known vulnerabilities in those components." }}
</p>
<p>
The SBOM is the “ingredient list”, the code are the ingredients, the build system is the “kitchen”
where those ingredients get built into the final piece of software which you consume.
{{ i18n "The SBOM is the “ingredient list”, the code are the ingredients, the build system is the “kitchen” where those ingredients get built into the final piece of software which you consume." }}
</p>
<h2>
Why are SBOMs important?
{{ i18n "Why are SBOMs important?" }}
</h2>
<p>
Open source software is used extensively in applications, but it has led to the discovery of high-
profile hacks and vulnerabilities. SBOMs are meant to provide the community and users of open
source with even more transparency, and an efficient way to identify (in the case of a risk)
individual files, libraries, dependencies, etc. thereby increasing the trust and confidence in the
use of open source software.
{{ i18n "Open source software is used extensively in applications, but it has led to the discovery of high-profile hacks and vulnerabilities." }}
{{ i18n "SBOMs are meant to provide the community and users of open source with even more transparency, and an efficient way to identify (in the case of a risk) individual files, libraries, dependencies, etc. thereby increasing the trust and confidence in the use of open source software." }}
</p>
<p>
The Linux Foundation thinks so too…
The Linux Foundation {{ i18n "thinks so too…" }}
</p>
<p>
The Linux Foundation and open source Security Foundation (OpenSSF) have also produced a
plan called the <ahref="https://openssf.org/oss-security-mobilization-plan/"target="_blank">Source Software Security Mobilization Plan</a> which calls for industry action
to develop software component frameworks, including SBOMs, to expedite discovery of and
response to future vulnerabilities like Log4j.
{{ i18n "The Linux Foundation and Open Source Security Foundation (OpenSSF) have also produced a plan called the" }} <ahref="https://openssf.org/oss-security-mobilization-plan/"target="_blank">Source Software Security Mobilization Plan</a> {{ i18n "which calls for industry action to develop software component frameworks, including SBOMs, to expedite discovery of and response to future vulnerabilities like Log4j." }}
</p>
<p>
...And the president himself
{{ i18n "...And the president himself" }}
</p>
<p>
An SBOM has been spotlighted as a key part of the solution presented by the president in the <ahref="https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/"target="_blank">Executive Order on Improving the Nation’s Cybersecurity.</a>
{{ i18n "An SBOM has been spotlighted as a key part of the solution presented by the president in the" }}<ahref="https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/"target="_blank">Executive Order on Improving the Nation’s Cybersecurity.</a>
</p>
<blockquote>
"the term “Software Bill of Materials” or “SBOM” means a formal record containing
@ -55,30 +46,25 @@ enumerates these components in a product. It is analogous to a list of
ingredients on food packaging."
</blockquote>
<h2>
What AlmaLinux Provides
{{ i18n "What AlmaLinux Provides" }}
</h2>
<p>
<ahref="https://build.almalinux.org/"target="_blank">The AlmaLinux Build System</a> has implemented SBOM into the pipeline for the reasons listed above, to enable:
<ahref="https://build.almalinux.org/"target="_blank">The AlmaLinux Build System</a>{{ i18n "has implemented SBOM into the pipeline for the reasons listed above, to enable:" }}
</p>
<ul>
<li>Tracing the whole build process from pulling sources from CentOS git repositories to releasing a verified and signed package in the public repository</li>
<li>Making the build pipeline more secure like ensuring that only trusted sources are used for builds, avoiding attack consequences, etc</li>
<li>Reducing the number of ways of data corruption</li>
<li>{{ i18n "Tracing the whole build process from pulling sources from CentOS git repositories to releasing a verified and signed package in the public repository" }}</li>
<li>{{ i18n "Making the build pipeline more secure like ensuring that only trusted sources are used for builds, avoiding attack consequences, etc" }}</li>
<li>{{ i18n "Reducing the number of ways of data corruption" }}</li>
</ul>
<h3>How are we doing this?</h3>
<p>AlmaLinux is leveraging Codenotary’s open source <ahref="https://cas.codenotary.com/"target="_blank"> Community Attestation Service</a> (CAS) to provide administrators with authentication, verification and full SBOM visibility.</p>
<h3>{{ i18n "How are we doing this?" }}</h3>
<p>{{ i18n "AlmaLinux is leveraging Codenotary’s open source" }}<ahref="https://cas.codenotary.com/"target="_blank"> Community Attestation Service</a> (CAS) {{ i18n "to provide administrators with authentication, verification and full SBOM visibility." }}</p>
<ul>
<li>CAS stores all signatures inside of <ahref="https://immudb.io/"target="_blank">immudb</a>, the standard for open source for
immutable databases, used by some of the world’s leading companies and
governments.</li>
<li>CAS is protected against tampering. All attestation data is integrity-checked and
cryptographically verified by the CAS client. No one can change this data, not
AlmaLinux or anyone else.</li>
<li>CAS is also protected against MITM attacks. The encryption key is client-side
verified and checked before every communication.</li>
<li>{{ i18n "CAS stores all signatures inside of" }} <ahref="https://immudb.io/"target="_blank">immudb</a>{{ i18n ", the standard for open source for immutable databases, used by some of the world’s leading companies and governments." }}</li>
<li>{{ i18n "CAS is protected against tampering." }} {{ i18n "All attestation data is integrity-checked and cryptographically verified by the CAS client." }} {{ i18n "No one can change this data, not AlmaLinux or anyone else." }}</li>
<li>{{ i18n "CAS is also protected against MITM attacks." }} {{ i18n "The encryption key is client-side verified and checked before every communication." }}</li>
</ul>
<h2>Getting Started</h2>
<p>For more information, see the Almalinux wiki: <ahref="https://github.com/AlmaLinux/build-system/wiki/Codenotary-SBOM-integration">https://github.com/AlmaLinux/build-system/wiki/Codenotary-SBOM-integration</a></p>
<h2>{{ i18n "Getting Started" }}</h2>
<p>{{ i18n "For more information, see the Almalinux wiki:" }} <ahref="https://github.com/AlmaLinux/build-system/wiki/Codenotary-SBOM-integration">https://github.com/AlmaLinux/build-system/wiki/Codenotary-SBOM-integration</a></p>
Jonathan Wright
2 years ago