Q-and-A.md

Q-and-A

Here is a non-exhaustive list of questions and answers around the project

Q: How do I get an MFA token?

A: The Great MFA Distribution project has identified a list of critical OSS projects we will engage with first.
Details about the project and how to get a token can be found at the project’s repository.

Q: How do I install and setup an MFA token?

A: Depending on which token you’ve received, there are instructions and links in the project’s repository.

Q: How do I log in using an MFA token?

A: Depending on which token you’ve received, there are instructions and links in the project’s repository.

Q: How do I sign software code with an MFA token?

A: Depending on which token you’ve received, there are instructions and links in the project’s repository.

Q: Why is the OpenSSF doing this?

A: The security of open source supply chains and infrastructure has grown in importance in recent years. The OSSF feels projects such as the Great MFA Distribution along with other tools and techniques help improve the security and assurance of the integrity of open source software.

Q: Can I get more than one token for my project?

A: Yes!

Q: I got my token, but i can’t get it to work. What can I do?

A: Please see our guidance documentation for various cases.

Q: I set my MFA token up and started using it, but it has subsequently been lost/broken/misplaced/stolen. What should I do?

A: Please see our guidance documentation. As noted there, when you set up using your token you should also set up a mechanism to deal with those cases.