- Section
- archive
- Kind
- Archive · commissioned
- Reading time
- 8 min
Standardized Metadata: The Key to Next-Gen Dependency Security
01 November 2026
Dependency security spans software supply chains, but the best defense is a good offense. That means bringing safeguards to the front. A more proactive systems view is needed. Early action prevents problems from developing downstream.
At Open Source Summit North America 2025, maintainers launched a call to arms for standardized CI/CD metadata. They argued that automated build, test, and package data would make application workflows more secure and resilient. But first, the open source community needs a shared reference framework for formalizing the way CI/CD pipelines intake and output build data.
Today, tools produce a wealth of metadata, but there is no standardized way for them to consume and exchange it, the newly-formed CHAOSS package metadata working group noted in a report. The OpenSSF's more detailed process for open source is shaped by this finding. What is still missing is standardization for the many package manager formats currently in use. That means security data is disappearing into a black box as it moves between tools, dependencies, and repositories.
And worse, that data is often out of reach of the processes that need it most: automated dependency tracking, build provenance, and vulnerability management. Damián Vicino, security lead at the Linux-focused technology firm Axcium, detailed the challenges he faced gathering package metadata from more than 20 package managers at Open Source Summit. Each manager used a different data model, making it labor-intensive to check versioning, dependencies, and security information.
Vicino, like many other developers and security researchers in attendance, found that the root problem is a lack of comprehensive metadata standards for the entire software development cycle. His work across the metadata landscape is addressing these gaps and is ongoing. Vicino described how he contributed $200,000 to the new OSS initiative Live-Burst and supports the CHAOSS Metadata Working Group organized under the Linux Foundation.
The fragmented state of security metadata is a longstanding issue, one that's not unique to the open source ecosystem. A recent CISA open source software security guidance document stressed the importance of using a machine-readable standard (such as JSON) for capturing all default project metadata. But those standards are not consistently implemented, especially in open source.
This may be a liability as automation becomes increasingly central to software security. The CISA noted that source code repository metadata, including commits, files, and release notes, must contain all required metadata defined in the project's schema. That includes essential fields such as supply chain components and license agreements, particularly if the code is to be reused or integrated into other systems. The guidance recommends JSON to facilitate automated provenance and inventory tracking.
So far, in the open source world, those standards are being created on an ecosystem-by-ecosystem basis. At Open Source Summit, participants identified key areas of CI/CD metadata to focus on, including commit records, test results, and deployment logs. The CDF project's standard is simply to expose the metadata clearly in the first place — to give committers, packagers, and release engineers a way to read, write, and exchange it.
And while significant progress is being made, a gap remains.
In 2024, Vicino and other developers organized a CHAOSS package metadata working group. Its mandate was to examine the gaps in metadata model alignment between software package managers and existing standards such as SPDX, CycloneDX, and OpenChain. The group focused first on license metadata, since it's the most standardized field. But what it found was "inconsistencies", to quote Vicino. Some ecosystems consistently use unambiguous SPDX-style declarations, while others rely on an ambiguous free-form field, and some don't even have a license field defined.
The working group's advice to developers comes down to formal project hygiene. Adopt clear and consistent metadata schemas, the group said, and critically, document them. Add CI validation to maintain the metadata properly. Most importantly, attach the metadata to your repository files, to make the project both auditable and discoverable.
"When you license software using an online tool, you assume it gets tagged correctly," Vicino said. "I don't know that that works for open source packages." The root cause is fragmented metadata schemas, metadata mapping between them, and ambiguity, he argued.
Progress is being made down to the tooling level. Open source maintainers are implementing most of what's recommended. Documentation guides and platforms like GitHub typically advise open source maintainers to create and maintain repository files that are both human- and machine-readable. That means keeping a README, CONTRIBUTING, LICENSE, CODEOWNERS, SECURITY, and CLASSIFIED.md in the repo root. It also means using a consistent file-based schema for licensing, security, and governance docs.
But the guidelines seem to have fallen short. Streamlining metadata behavior throughout the entire SDLC, from development to release, is the necessary evolution. That's what the CHAOSS and CDF efforts are focused on, and it's one that the industry may need to lead.
CI/CD and package manager tools generate a wealth of security-critical metadata, but they create it inconsistently. That leaves project managers struggling to interpret the results, leaving development and security teams without clear guidance, and creating unnecessary work for open source maintainers.