Chainguard Forks Abandoned Open Source Projects to Plug Security Gaps

In a move to shore up the internet's fragile open source supply chain, Chainguard has begun forking archived but heavily used repositories to provide ongoing security maintenance and dependency updates. The initiative, led by CEO Dan Lorenc, aims to prevent vulnerabilities in abandoned software from compromising millions of systems.

'Many widely deployed open source projects are effectively unmaintained, yet they underpin critical infrastructure,' Lorenc said in an interview. 'Forking them allows us to apply patches and keep them viable until the community can take over.'

Background

The problem of unmaintained open source projects has long been known, with the Heartbleed bug in 2014 serving as a wake-up call. Since then, thousands of projects have been archived or abandoned, leaving dependencies vulnerable. The Log4j crisis further highlighted the risks of relying on volunteer maintainers.

Chainguard's approach targets repos that are still widely used but no longer updated. These packages often serve as indirect dependencies, meaning a single unpatched flaw can cascade through thousands of applications.

What This Means

Chainguard's approach offers a stopgap for organizations that cannot immediately migrate away from archived libraries. It buys time for the community to find permanent solutions, but also raises questions about the sustainability of open source funding and maintenance.

For developers, the forks provide a trusted source of patches without requiring them to abandon familiar tooling. However, reliance on a single vendor for critical maintenance introduces a new concentration risk.

'We're not trying to take over the project long term,' Lorenc emphasized. 'Our goal is to provide a safety net while the ecosystem figures out better governance models.'

Urgency and Scale

The number of archived repos that Chainguard is forking has not been disclosed, but early targets include libraries in the npm, PyPI, and RubyGems ecosystems. Each fork undergoes a security audit before patches are released.

Industry experts warn that the scale of the problem is staggering. A 2023 analysis by Security Research Labs found that over 20% of the top 1,000 npm packages had no recent commits. 'The open source maintenance crisis is a ticking time bomb,' said Dr. Emily Zhao, a cybersecurity researcher.

Industry Response

Major tech companies have welcomed Chainguard's initiative. Google and Microsoft have both pledged to support the forking effort through financial contributions and shared threat intelligence. 'This is exactly the kind of proactive measure the industry needs,' said a Google spokesperson.

However, community advocates caution that forking alone is not enough. 'We need systemic changes in how open source projects are funded and maintained,' said Sarah Klein, executive director of the Open Source Security Foundation. 'Forking is a band-aid, not a cure.'

Chainguard plans to transition the forks back to community management once a sustainable maintainer structure is in place. 'We're not in this forever,' Lorenc stated. 'But while we are, we'll keep the lights on.'

The first batch of updated forks is expected to be released next month. Organizations relying on the affected packages are urged to audit their dependency trees and prepare to adopt the new versions.