The OpenSSF’s new baseline sets minimum security expectations for open-source projects — but not all developers agree it’s practical, scalable, or sufficient.