Trustable Software Framework for assuring integrity with open source based systems

This talk, presented by Lucas Biaggi and Roan Richmond from Codethink Ltd, introduces the Trustable Software Framework (TSF), a lightweight method for assessing and maintaining software integrity in complex open source systems. The framework addresses the challenge of verifying modern software systems by focusing on defined expected behaviors, tracking changes over time, and ensuring continuous validation of these expectations. Built around a graph-based model, TSF connects requirements, expectations, and claims through logical relationships, supporting evidence like test results to trace high-level objectives back to their implementation. The session emphasizes the integration of TSF into existing workflows using tools like Git and CI/CD pipelines to facilitate automated validation and maintain compliance without substantial overhead. Practical examples demonstrate the framework's applicability in both large platform projects and smaller components, highlighting how it can effectively ensure software supply chain integrity and compliance.