software-supply-chain

There are 5 repositories under software-supply-chain topic.

• murphysecurity / murphysec

  An open source tool focused on software supply chain security. 墨菲安全专注于软件供应链安全，具备专业的软件成分分析（SCA）、漏洞检测、专业漏洞库。

  securityscannerdependencyvulnerability-detectionsoftware-supply-chainscasoftware-composition-analysiscodescan
  Language:Go 1571

• XmirrorSecurity / OpenSCA-cli

  OpenSCA is an open source software supply chain security solution that supports the detection of open source dependencies, vulnerabilities and license compliance with a widely noticed accuracy by the community.

  scadevsecopssecuritysbomsoftware-bill-of-materialssoftware-composition-analysissoftware-supply-chainsoftware-supply-chain-securitystatic-analysisvulnerabilitieslicense-compliancecyclonedxspdxswid
  Language:Go 998

• aquasecurity / chain-bench

  An open-source tool for auditing your software supply chain stack for security compliance based on a new CIS Software Supply Chain benchmark.

  cisdevsecopsgogolangmisconfigurationopen-policy-agentsecuritysecurity-toolssoftware-supply-chainsoftware-supply-chain-securityvulnera
  Language:Go 699

• bureado / awesome-software-supply-chain-security

  A compilation of resources in the software supply chain security domain, with emphasis on open source

  reproducible-buildssupply-chain-securitydevsecopsvulnerability-scanningsecurity-vulnerabilityvulnerability-managementsupply-chain-attackssbompackage-managementdependency-managementstatic-analysissoftware-composition-analysisoss-compliancesoftware-supply-chainsoftware-supply-chain-securitydependenciescve-scanningattestationawesome-list
  254

• OWASP / Software-Component-Verification-Standard

  Software Component Verification Standard (SCVS)

  supply-chainsoftware-supply-chainopen-sourcebest-practicesscrmcscrmscvsowasp
  Language:Python 131

• in-toto / in-toto-golang

  A Go implementation of in-toto. in-toto is a framework to protect software supply chain integrity.

  in-totosecuritysoftware-supply-chain
  Language:Go 114

• osssanitizer / maloss

  Towards Measuring Supply Chain Attacks on Package Managers for Interpreted Languages

  open-sourcenpmrubygemspypipackagistmavenstatic-analysisdynamic-analysissoftware-supply-chainattack-detectionsecurity
  Language:Java 108

• phylum-dev / cli

  Command line interface for the Phylum API

  climalwaremalware-detectionrustsecure-software-supply-chainsecuritysecurity-scansoftware-supply-chainsoftware-supply-chain-securitysupply-chainvulnerabilities
  Language:Rust 98

• tiiuae / sbomnix

  A suite of utilities to help with software supply chain challenges on nix targets

  bill-of-materialscpecyclonedxdependenciesnixpurlpythonsbomsbom-generatorsbom-toolsecuritysoftware-bill-of-materialssoftware-supply-chainsoftware-supply-chain-securityspdx-sbomstatic-analysisvulnerability-scanners
  Language:Python 97

• jhermann / dependency-check-py

  :closed_lock_with_key: Shim to easily install OWASP dependency-check-cli into Python projects

  owaspdependency-analysissecuritypythoncli-utilitysoftware-supply-chaincve-scanningvulnerability-detectionsecurity-auditsoftware-composition-analysis
  Language:Python 48

• philips-labs / slsa-provenance-action

  Github Action implementation of SLSA Provenance Generation

  github-actionsgithub-actionin-totoslsaprovenancesoftware-supply-chainsecuritysecurity-toolshacktoberfest
  Language:Go 44

• in-toto / community

  in-toto is a framework to secure the software supply chain.

  cncfin-totosoftware-supply-chainsoftware-supply-chain-security
  41

• meta-fun / awesome-software-supply-chain-security

  Sharing software supply chain security open source projects

  securitysecurity-toolssupply-chain-securitysupply-chainsbomsastcicdkubernetesdevopssoftware-supply-chainsoftware-supply-chain-securityvulnerability-scannersoftware-composition-analysisdependency-analysis
  37

• in-toto / in-toto-rs

  A rust implementation of in-toto

  securitysoftware-supply-chain
  Language:Rust 31

• CMS-Enterprise / sbom-harbor

  Repository for the SBOM Harbor.

  sbomsoftware-bill-of-materialssoftware-supply-chainsoftware-supply-chain-security
  Language:Rust 17

• joshlarsen / driftbot

  A simple web app software supply chain monitoring toolkit

  software-supply-chainmagecartcrypto-miningsecurityappsecformjacking
  Language:JavaScript 12

• nais / salsa

  SLSA level 3 action

  slsaprovenancesoftware-supply-chainartifactintegrityci-cdend-to-endsoftware-artifact
  Language:Go 11

• sethvargo / go-malice

  A malicious package to demonstrate the importance of software supply chain security.

  securitysoftware-supply-chaindont-use-this-no-really
  Language:Go 7

• lmco / ChaordicLedger

  The ChaordicLedger is the implementation of a design for a combination of Distributed Ledger Technology (DLT) and a Distributed File System (DFS) to create a secure, enterprise-grade platform for storing interlinked project artifacts.

  distributed-file-systemdistributed-storagedistributed-ledger-technologyblockchain-technologyipfs-blockchainobsidiansmart-contractbusiness-intelligencesoftware-supply-chaindigital-transformationdevelopment-workflow
  Language:Shell 5

• paulveillard / cybersecurity-software

  An ongoing & curated collection of awesome software best practices and techniques, libraries and frameworks, E-books and videos, websites, blog posts, links to github Repositories, technical guidelines and important resources about Software in Cybersecurity

  software-developmentsoftware-engineeringsoftware-factorysoftware-securitysoftware-supply-chainsoftware-supply-chain-securitysoftware-teamsoftware-testing
  4

• santiago-mooser / Software-supply-chain-security

  Capstone project assessing the current state of the software supply chain in open-source projects

  dockerfinal-year-projectpythonsoftware-supply-chainsoftware-supply-chain-securitysupply-chain
  Language:Python 4

• amalthundiyil / vigil

  software supply chain protection for javascript and python dependencies 🔐

  security-scannersoftware-supply-chainvulnerability-assessmentvulnerability-scannersecurityhacktoberfest
  Language:TypeScript 3

• IQTLabs / OSSNutritionLabelPrototypes

  Prototype Open Source Software Nutrition Labels

  open-sourcevisualizationsoftware-supply-chain
  Language:TypeScript 3

• pbnj / mitigating-malicious-packages

  🗒️ Researching & exploring how to mitigate malicious 3rd-party packages (e.g. npm, pip, rubygems ...etc)

  stracecontainerssoftware-supply-chainsecuritydocker
  Language:Shell 3

• hi-artem / provenance-generator-buildkite-plugin

  A proof-of-concept SLSA provenance generator for Buildkite.

  buildkite-pluginbuildkiteslsaprovenancesoftware-supply-chain
  Language:Go 2

• toddysm / cssc-pipeline

  Sample CI/CD pipeline for creating container images with provenance details.

  containersnotarysignature-verificationsignaturessigstoresoftware-supply-chainsoftware-supply-chain-security
  Language:Shell 1

• dhruvmisra / changelog-focus

  Dev tool to aggregate and focus on the changelog relevant to your codebase

  aggregatorchangelogdependenciesdevtoolfocussoftware-supply-chainsupply-chain
  Language:TypeScript 0

• abe-winter / compare-wheel

  compare wheel built from git with what's on pypi

  package-managementsoftware-supply-chain
  Language:Python

• jspeed-meyers / the-broken-links-project

  A site for an IQT R&D initiative on software supply chain security.

  software-supply-chaincybersecuritysecurity-tools