Open source

ANSSI’s initiatives and general stance on open source

According to ANSSI, open source is and should remain central to the mastery of digital solutions, the security of software chains, the protection and resilience of information systems and digital commons, and the support of innovative technologies and solutions.

This stance is influenced by the opportunities generated by open source in terms of adaptation, software design and supply chain mastery, sustainability, auditability, portability, and integration. Free software [1] facilitates the sharing of knowledge, enables peer evaluation, and takes advantage of collective intelligence. For ANSSI, open source facilitates the development of skills essential to its missions and to the mastery of key technologies, and makes it possible to share these skills for specific use cases.

In this context, taking into account the limitations of “security through obscurity” (basing the security of a system on the assumption that attackers are not familiar with its operating principles), ANSSI promotes the principles of “secure-by-design” (integrating security from the conception of the system rather than at a later point) and “open-by-default” (opening source codes and data), in keeping with its missions, while ensuring that no sensitive artefacts or operational configurations are exposed.

ANSSI actively contributes to the open-source ecosystem by sharing various projects. These initiatives are limited to specific domains, as the development of software for external actors is not ANSSI’s first priority.

The publication of projects allows ANSSI to:

  • share its technical and scientific capabilities, using this reach to attract new talent and maintain its expertise;
  • provide transparency with regards to the operational tools it uses when assisting beneficiaries;
  • support its partners’ ecosystem by sharing its tools;
  • improve cooperation between partners via interoperable means.

Beyond the (Opens a new window) legal framework [2], ANSSI also chose to apply an open-source approach to its technical work, promoting technological development through various projects. These initiatives demonstrate that open source can be a credible tool to sustain dynamics of development and diffusion.

For the publication of its source code, ANSSI selected licences from a (Opens a new window) list of licences authorised by decree. From this list, the choice of licence is determined by the intended purpose of each project, with a preference for permissive licences (particularly Apache 2.0) to limit restrictions when reusing the source code (including in commercial settings). If reusing and integrating source code in a proprietary model is considered a threat to the publication’s target objective, then a licence with a reciprocity requirement (such as the GNU GPL family) is used.

ANSSI has defined several categories of projects published in open source, requiring varying levels of support and engagement to ensure their maintenance.

  • Doctrinal projects disseminating elements of the Agency’s doctrine or accompanying its publication: technology demonstrator, reference implementation, source code used to produce a scientific article or to generate data (research artefacts), content providing a concrete illustration of the Agency’s recommendations (“actionables”), etc. These projects are shared for informational purposes and maintained by ANSSI over the period of relevance of the article or of the associated recommendation. Users, integrators, and contributors may make them their own, to reproduce research results or to implement recommendations, bearing in mind that they do not come with ANSSI’s support.
  • Internal tools: projects developed to meet ANSSI’s internal needs, published for the sake of transparency or to share useful resources with the ecosystem. Depending on the specific framework of each project, external contributions may be integrated without systematic guarantees or user support.
  • External tools: tools provided to ANSSI’s beneficiaries and partners (such as the CERTs), directly accessible or via the services provided by ANSSI. Governance over these projects is ensured internally, their reuse is encouraged, and support may be provided to beneficiaries and partners should the Agency’s resources allow for it.

ANSSI primarily publishes projects within the (Opens a new window) ANSSI-FR Github organisation. Some large-scale projects, or projects whose maintenance is intended to be shared, are hosted in dedicated Github organisations, (Opens a new window) referenced from the main Github organisation.

For each of these projects, a “level of openness” is attributed to the source code, on the basis of a (Opens a new window) classification established by the interministerial directorate in charge of digital affairs (DINUM):

· Level A – contributive: the source code is published, external contributions are actively sought and processed.

· Level B – open: the source code is published, external contributions are processed but not actively sought.

· Level C – published: the source code is published but external contributions are not processed.

Open-source project transfer cases

Though the development of software is not ANSSI’s first priority, it does publish open-source projects which may be likened to industrial products or which might be used to develop solutions. When ANSSI must withdraw from a project but nonetheless wishes to ensure its sustainability, it may initiate the transfer of its governance to identify an external actor capable of continuing the work.

Any external actor interested in taking over a project may reach out to its maintainers or otherwise contact the following addresses: industries@ssi.gouv.fr or opensource@ssi.gouv.fr.

Back to top

ANSSI’s agents contribute to open-source projects maintained by external actors, in various contexts and as part of the Agency’s missions.

These contributions may be made to open-source projects of interest used by the Agency’s beneficiaries. Whenever possible, the Agency contributes as upstream as possible to optimise the use of resources and amplify positive effects on the cybersecurity of the digital ecosystem. For example, it may contribute to the security of base infrastructure components and operating system kernels (such as the Linux kernel).

Contributions may also help to improve the cybersecurity of software used by security researchers in the academic field or in the Agency’s sphere of operational partners.

Lastly, opportunistic contributions are more particularly made to projects used internally by the Agency (see “Using open-source solutions”). These contributions can range from simple bug fixes to adaptations intended to conform them to specific use cases (e.g. operating in isolation mode, disconnected from the Internet), or to new uses (e.g. the inclusion of new cryptographic algorithms).

These efforts allow ANSSI to develop expertise in the software concerned, and their publication contributes to the promotion of the Agency’s work.

The Agency’s contribution to public open-source projects also allows it to expand its field of action:

  • it reduces its teams’ workload by avoiding the reproduction of specific adaptations in parallel with a project’s public evolutions [3];

the improvement of a product’s security (or of its features – for a security tool, for example) not only benefits ministries and operators of vital importance (OIV), but also ANSSI’s partners and the entire community of users.

Back to top

Open-source actors across the digital ecosystem

ANSSI’s investment in open source is not isolated; rather, it is made in conjunction with numerous actors of the digital ecosystem:

The latter two actors, more particularly, have instigated developments in public policy pertaining to digital commons which may impact all citizens. It is also at the political level that questions of digital sovereignty, of independence, and of the mastery technological means[PY1] – which include open source – are addressed.

Open source as a lever for action in ANSSI’s industrial policy

ANSSI’s industrial policy seeks to ensure that the digital ecosystem provides users with suitable and secure cybersecurity solutions which are adapted to their needs. While free software has become central to digital value chains, the link between open source and ANSSI’s industrial policy is recent and still in development. Open source has the potential to support the Agency’s industrial policy, by promoting innovation, engaging foundations, and bringing actors together.

Security evaluations

Since 2017, ANSSI has been funding open-source software security evaluations with the intention of improving the security of software components used directly by the Agency’s beneficiaries, or indirectly via their integration in commercial products.

Each year, ANSSI selects open-source software to undergo ad hoc security audits or security evaluations based on the First Level Security Certification (CSPN) scheme. Any identified vulnerabilities are reported to the project maintainer, allowing the Agency to facilitate remediation.

Back to top

ANSSI demonstrates a pragmatic approach to the use of free software, based on its different infrastructure, IT, and business needs.

It does not shun the use of proprietary software when it is necessary, but believes free software to offer a number of advantages – notably with regards to transparency and to the mastery of digital environments – and to allow the effective management of dependencies on external actors. (Opens a new window) Article 16 of the Law for a Digital Republic (Loi pour une République numérique) states that administrations “encourage the use of free software and open formats during the development, purchase, or use of all or part of these information systems”.

The use of free software allows the Agency to maintain a mastery of its business digital infrastructure, achieved through the transparency provided by the availability of the source code and by the possibility for third-parties to use it. This limits the risks of dependence, along with the risks associated with strategy changes within the commercial entities which control the software. It is possible to analyse the source code and dependencies [5] or to have them analysed, to modify the code or have it be modified to meet specific needs [6] and, in some extreme cases, to take over the maintenance of a project if it has been abandoned or if it is headed in a direction which appears to be inconsistent with ANSSI’s usage.

The development and maintenance of software are both specific tasks, and free software may be used in a commercial setting. It can be useful for ANSSI to delegate these tasks to specialised companies, in an incredibly rich (French and European) ecosystem. In this context, contract documents should emphasise the importance of access to source code under a free software licence, or of the obtention of patrimonial rights[LGF1] [PY2] . This should also facilitate the pooling of various resources provided by entities to request modifications which will ultimately be publicly accessible.

To this end, ANSSI may draw on various resources (which can be accessed by the entire administration) :

Back to top

For additional information

ANSSI’s work on open source is visible across the ecosystem, through various channels:

ANSSI is also involved in the (Opens a new window) BlueHats community (moderated by DINUM) and in the French (Opens a new window) OSPO community.

Terminology

Open-source software / free software: Open-source software (OSS) and free software (FS) are similar concepts founded on a common fundamental principle: access to source codes and the freedom to use, modify, and redistribute software. This principle is concretised by the software’s redistribution licence agreement (see the (Opens a new window) list of licences considered to be free by the Open Source Initiative). Their main differences are philosophical, in their ideological approach, and in certain legal nuances. In this document, differences in the definitions given to OSS and FS are voluntarily disregarded and the two terms are used interchangeably, unless explicitly stated otherwise. Readers may also refer to the (Opens a new window) definition provided by the Open Source Initiative.

Beneficiary: The Agency’s beneficiaries are all of the state services and operators which may benefit from its services. Among these are public bodies (ministries, institutions, jurisdictions, independent authorities, local authorities), operators of vital importance (OIV) and essential service operators, and – eventually – NIS 2 entities.

Contribution: Umbrella term used to refer to the various ways in which an entity may be involved in a project, whether it be in coding, community support, the provision of resources or ideas for a project, modification suggestions, features or patches, etc.

Open-source ecosystem: Subset of the digital ecosystem, comprised of all of the actors, practices, artefacts, and infrastructures involved in the production, dissemination, and maintenance of software whose source code has been released under a free licence ( (Opens a new window) approved by the Open Source Initiative) to allow its study, modification, and redistribution. Its key components are:

Open-source project of interest: ANSSI considers an open-source software or component to be of interest if it meets the following two conditions:

Open-source project transfer: In the context of an open-source project as part of which ANSSI plays the role of developer, refers to each of the processes, actions, and means implemented by ANSSI to transfer this role to other organisations or communities, with the intention of reusing and sustaining the open-source project.

Maintainer: The project maintainer is the person or entity in charge of governance. They decide whether or not to include new code and features, what roadmap the project should follow, etc. This entity is responsible for user support, maintenance in operational or security condition. Within ANSSI, project maintenance is entrusted to an entity (office or division) to ensure the sustainability of the project in case of personnel changes.

Open Source Program Office (OSPO): An OSPO is an organisation and institutional structure which supports and hastens the use, creation, and implementation of open-source software. Within an institution, the OSPO is the centre of gravity and competence in matters of open source. It works strategically to meet the institution’s political objectives when they are related to open source. ( (Opens a new window) source)

1 In this document, the terms “open source” and “free software” are used interchangeably. More details in the “Terminology” section.

2 More particularly, the French code of relations between the public and the administration (CRPA) and its articles:

(Opens a new window) L300-2 which includes source codes in the “administrative documents” affected by the text;

(Opens a new window) L311-1, (Opens a new window) L311-2 and (Opens a new window) L311-5 for the publication itself;

(Opens a new window) L323-1 to R323-7 for reuse licences.

The interministerial directorate in charge of digital affairs (DINUM) also provides complementary elements on its website.

3 The acceptance of a contribution to a given public project does not automatically imply its maintenance by the project; some open-source projects might require long-term engagement for merged features, which must be integrated when planning efforts.

4 The field of higher education is, in fact, encouraged to use it in (Opens a new window) article L123-4-1 of the French Education Code.

5 See also: paragraph on “Security evaluations”

6 See also: paragraph on “Contributing to external open-source projects”

7 Open source Program Office; see Terminology.

Back to top