sbom

There are 16 repositories under sbom topic.

syft
anchore / syft
CLI tool and library for generating a Software Bill of Materials from container images and filesystems
containers docker go golang static-analysis tool oci sbom spdx cyclonedx hacktoberfest
Language:Go 5925
RetireJS / retire.js
scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.
vulnerabilities scanner firefox-extension grunt-plugins javascript vulnerable-libraries insecure-libraries chrome-extension build-tool security software-composition-analysis sbom sbom-generator sbom-tool
Language:JavaScript 3633
dependency-track
DependencyTrack / dependency-track
Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.
appsec bill-of-materials bom component-analysis cyclonedx devsecops nvd ossindex owasp package-url purl sbom sca security security-automation software-composition-analysis software-security vulndb vulnerabilities vulnerability-detection
Language:Java 2534
aboutcode-org / scancode-toolkit
:mag: ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase, the Google Summer of Code, Azure credits, nexB and others generous sponsors!
license copyright packages dependencies spdx provenance license-scan copyright-scan licensing spdx-licenses open-source-licensing oss-compliance license-checking software-composition-analysis purl package-url sbom sca cyclonedx dependency-graph
Language:Python 2048
HummerRisk / HummerRisk
HummerRisk 是云原生安全平台，包括混合云安全治理和云原生安全检测。
cloud-custodian cloud-native cloud-native-security compliance compliance-as-code cspm k8s-security kubernetes-security prowler sbom security trivy vulnerability
Language:Java 1776
ort
oss-review-toolkit / ort
A suite of tools to automate software compliance checks.
compliance copyright copyright-scan cyclonedx dependencies dependency-graph hacktoberfest license license-checking license-management license-scan open-source-licensing ospo oss-compliance package-manager package-scan sbom sbom-generator sca spdx
Language:Kotlin 1553
microsoft / sbom-tool
The SBOM tool is a highly scalable and enterprise ready tool to create SPDX 2.2 compatible SBOMs for any variety of artifacts.
sbom sbom-generator
Language:C# 1543
lunasec-io / lunasec
LunaSec - Dependency Security Scanner that automatically notifies you about vulnerabilities like Log4Shell or node-ipc in your Pull Requests and Builds. Protect yourself in 30 seconds with the LunaTrace GitHub App: https://github.com/marketplace/lunatrace-by-lunasec/
tokenization web-security compliance security soc2 pci-dss gdpr zero-trust devsecops log4shell dependency-analysis scanning cybersecurity security-tools scanning-tool cve-scanning sbom sbom-generator continuous-delivery software-composition-analysis
Language:TypeScript 1431
zarf
zarf-dev / zarf
DevSecOps for Air Gap & Limited-Connection Systems. https://zarf.dev/
k8s airgap cloud-native helm government dod k3s kustomize oci cosign docker docker-registry gitops kubernetes sbom
Language:Go 1318
openclarity
openclarity / openclarity
OpenClarity is an open source tool built to enhance security and observability of cloud native applications and infrastructure
cloud exploits kubernetes leaked-secrets malware rootkits sbom scanner security supply-chain virtual-machine vulnerabilities
Language:Go 1310
intel / cve-bin-tool
The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 200 common, vulnerable components (openssl, libpng, libxml2, expat and others), or if you know the components used, you can get a list of known vulnerabilities associated with an SBOM or a list of components and versions.
cve cvss devsecops hacktoberfest python sbom sbom-tool security security-automation security-tools swrepo system-tools vulnerabilities vulnerability
Language:Python 1171
XmirrorSecurity / OpenSCA-cli
OpenSCA is an open source software supply chain security solution that supports the detection of open source dependencies, vulnerabilities and license compliance with a widely noticed accuracy by the community.
sca devsecops security sbom software-bill-of-materials software-composition-analysis software-supply-chain software-supply-chain-security static-analysis vulnerabilities license-compliance cyclonedx spdx swid
Language:Go 1054
owasp-dep-scan / dep-scan
OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.
vulnerability-scanners cve dependency-analysis risk-audit containers sbom sca dependency-audit compliance cyclonedx devsecops security-audit security-tools vex reachability-analysis supply-chain-security
Language:Python 975
tern-tools / tern
Tern is a software composition analysis tool and Python library that generates a Software Bill of Materials for container images and Dockerfiles. The SBOM that Tern generates will give you a layer-by-layer view of what's inside your container in a variety of formats including human-readable, JSON, HTML, SPDX and more.
python containers oss-compliance sbom docker compliance spdx tool dependencies software-composition-analysis risk-management open-source supply-chain-security metadata-extraction
Language:Python 951
package-url / purl-spec
A minimal specification for purl aka. a package "mostly universal" URL, join the discussion at https://gitter.im/package-url/Lobby
purl package-url package url cyclonedx dependencies package-management sbom spdx
665
ARPSyndicate / puncia
The Panthera(P.)uncia of Cybersecurity - Official CLI utility for Subdomain Center & Exploit Observer.
arpsyndicate exploit subdomain sbom sbom-tool vulnerability cyclonedx cyclonedx-sbom
Language:Python 632
rust-secure-code / cargo-auditable
Make production Rust binaries auditable
cargo-plugin cargo-subcommand rust rust-lang sbom security-audit security-automation security-tools
Language:Rust 623
CycloneDX / cdxgen
Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server.
bom sca cyclonedx sbom docker oci containers owasp package-url purl software-bill-of-materials saasbom supply-chain cbom
Language:JavaScript 520
bomber
devops-kung-fu / bomber
Scans Software Bill of Materials (SBOMs) for security vulnerabilities
cyclonedx devsecops golang gomodule oss sbom security security-automation security-tools spdx supply-chain supplychain syft vulnerability-scanners
Language:Go 487
sandworm-hq / sandworm-audit
Security & License Compliance For Your App's Dependencies 🪱
d3-visualization dependencies dependencies-graph dependencies-tree security security-tools supply-chain vulnerabilities vulnerability vulnerability-scanners cli compliance license-checking license-compliance license-management sbom audit
Language:JavaScript 470
awesomeSBOM / awesome-sbom
A curated list of SBOM (Software Bill Of Materials) related tools, frameworks, blogs, podcasts, and articles
awesome awesome-repos awesome-sbom sbom sbom-examples sbom-generator software-bill-of-materials
458
meta-package-manager
kdeldycke / meta-package-manager
🎁 wraps all package managers with a unifying CLI
npm pip homebrew macos mac-app-store ruby-gem linux windows apt flatpak php-composer yarn snap steam xbar package-manager sbom package-url cyclonedx spdx
Language:Python 456
microsoft / component-detection
Scans your project to determine what components you use
static-analysis dependencies package-management software-composition-analysis sbom software-bill-of-materials
Language:C# 407
fsfe / reuse-tool
reuse is a tool for compliance with the REUSE recommendations.
python copyright licensing linter reuse analyzer fsfe spdx free-software sbom
Language:Python 379
specification
CycloneDX / specification
OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction. SBOM, SaaSBOM, HBOM, AI/ML-BOM, CBOM, OBOM, MBOM, VDR, and VEX
bill-of-materials bom software spdx cpe license software-bill-of-materials sbom cyclonedx swid owasp supply-chain standard specification saasbom vex mbom machine-learning cbom tc54
Language:XSLT 351
chainloop-dev / chainloop
Chainloop is an Open Source evidence store for your Software Supply Chain attestations, SBOMs, VEX, SARIF, CSAF files, QA reports, and more.
compliance cyclonedx devsecops sbom sbom-distribution security spdx supply-chain-security metadata-platform sbom-discovery license open-source-licensing ospo oss-compliance regulated-industry attestation in-toto slsa slsa-provenance
Language:Go 344
xeol-io / xeol
A scanner for end-of-life (EOL) software and dependencies in container images, filesystems, and SBOMs
end-of-life security eol release-policy sbom compliance outdated-packages fedramp nist outdated-libraries pci-dss outdated-dep
Language:Go 337
owasp-dep-scan / blint
BLint is a Binary Linter to check the security properties, and capabilities in your executables. Since v2, blint is also an SBOM generator for binaries.
binary fuzzing malware cyclonedx sbom supply-chain-analytics supply-chain-security depscan
Language:Python 328
bom
kubernetes-sigs / bom
A utility to generate SPDX-compliant Bill of Materials manifests
bom go golang kubernetes sbom spdx
Language:Go 325
trailofbits / it-depends
A tool to automatically build a dependency graph and Software Bill of Materials (SBOM) for packages and arbitrary source code repositories.
dependency-analysis dependency-graph hacktoberfest hacktoberfest2021 sbom sbom-generator vulnerability-scanner
Language:Python 325
cyclonedx-cli
CycloneDX / cyclonedx-cli
CycloneDX CLI tool for SBOM analysis, merging, diffs and format conversions.
bom bill-of-materials software-bill-of-materials purl package-url sbom cyclonedx spdx owasp sbom-generator obom mbom saasbom vex hacktoberfest
Language:C# 294
cyclonedx-maven-plugin
CycloneDX / cyclonedx-maven-plugin
Creates CycloneDX Software Bill of Materials (SBOM) from Maven projects
bom spdx maven maven-plugin bill-of-materials software-bill-of-materials package-url purl sbom cyclonedx owasp sbom-generator obom mbom saasbom vex
Language:Java 287
bureado / awesome-software-supply-chain-security
A compilation of resources in the software supply chain security domain, with emphasis on open source
reproducible-builds supply-chain-security devsecops vulnerability-scanning security-vulnerability vulnerability-management supply-chain-attacks sbom package-management dependency-management static-analysis software-composition-analysis oss-compliance software-supply-chain software-supply-chain-security dependencies cve-scanning attestation awesome-list
273
cyclonedx-python
CycloneDX / cyclonedx-python
CycloneDX Software Bill of Materials (SBOM) generator for Python projects and environments
python pip bom sbom spdx bill-of-materials software-bill-of-materials package-url purl cyclonedx owasp sbom-generator python3 poetry conda requirements environment sbom-tool
Language:Python 237
ckotzbauer / sbom-operator
Catalogue all images of a Kubernetes cluster to multiple targets with Syft
sbom kubernetes k8s operator supply-chain-security
Language:Go 188
cyclonedx-dotnet
CycloneDX / cyclonedx-dotnet
Creates CycloneDX Software Bill of Materials (SBOM) from .NET Projects
bom spdx dotnet dotnet-core bill-of-materials software-bill-of-materials package-url purl sbom cyclonedx owasp sbom-generator hacktoberfest obom mbom saasbom vex
Language:C# 173