What's New and What's Next in Security for Eclipse Foundation Projects

For the July edition of EMO Committer Office Hours, we were joined by Mikaël Barbero, Head of Security, for a session on what’s new in security for Eclipse Foundation projects.

Topics included Mythos scanning, vulnerability reporting intake mechanism, and Code signing.

Notes

• How to create and SBOM for Eclipse Foundation project:
  • https://eclipse-csi.github.io/security-handbook/sbom/index.html
  • https://sbom.eclipse.org
  • https://eclipse-csi.github.io/security-handbook/sbom/tooling.html
• How to use dash license tool:
  • https://www.eclipse.org/projects/articles/officehours/2025-05/
• Any security discussion please refer to:
  • https://github.com/orgs/eclipse-csi/discussions
• Free CRA training hosted by ORC WG
  • https://orcwg.org/training/