bureado

chainloop

Chainloop is an Open Source evidence store for your Software Supply Chain attestations, SBOMs, VEX, SARIF, CSAF files, QA reports, and more.

protobom

A universal SBOM representation in protocol buffers

sealed-secrets

A Kubernetes controller and tool for one-way encrypted Secrets

kubesec

Security risk analysis for Kubernetes resources

beyla

eBPF-based autoinstrumentation of web applications and network metrics

package-analysis

Open Source Package Analysis

wg-best-practices-os-developers

The Best Practices for OSS Developers working group is dedicated to raising awareness and education of secure code best practices for open source developers.

blueprint-securesoftwarepipeline

For engineers and security teams driving fast and secure software supply chains

overlay

Overlay is a browser extension helping developers evaluate open source packages before picking them

copacetic

🧵 CLI tool for directly patching container images using reports from vulnerability scanners

openssl-nov-1-critical-cve-2022-tracking

hpsm

annotate-registry-artifacts

CLI for adding OCI annotations to existing registry artifacts

image-layer-provenance

Container image provenance spec that allows tracing CVEs detected in registry images back to a CVE's source of origin.

SecureSoftwareSupplyChain

This repo is a consolidation of Secure Software Supply Chain resources, such as talks, whitepapers, conferences and more.

unlocker

⚠️ Replaced by ItalyPaleAle/Revaulter! -- Wrap and unwrap keys using a key vault with admin consent

oss-ssc-framework

Open Source Software Secure Supply Chain Framework

OSSGadget

Collection of tools for analyzing open source packages.

dotnet

Ubuntu ROCKs for the .NET runtime and family

chisel

omega-stracedb

A repository of strace results for lots of packages.

template-analyzer

Template scanner for security misconfiguration and best practices

security-devops-action

Microsoft Security DevOps for GitHub Actions.

Microsoft-Defender-for-Cloud

Welcome to the Microsoft Defender for Cloud community repository

sbom-tool

The SBOM tool is a highly scalable and enterprise ready tool to create SPDX 2.2 compatible SBOMs for any variety of artifacts.

DevSkim

DevSkim is a set of IDE plugins, language analyzers, and rules that provide security "linting" capabilities.

draft-birkholz-scitt-architecture

A specification including, problem statement, use cases, requirements, and architectural constituents for a Transparency Service in support of Supply Chain Integrity, Transparency, and Trust

zas

Most simple static website generator in Golang.

linux-package-repositories

Microsoft Packaged Linux Software (DEBs, RPMs, etc) are hosted on packages.microsoft.com (PMC) made available as native Linux repositories for use with package managers like APT, YUM, etc.

awesome-software-supply-chain-security

A compilation of resources in the software supply chain security domain, with emphasis on open source