supply-chain-security topic

Authenticate a tarball through a signed tag in a git repository (with reproducible builds)

kpcyrd

List your dependencies capabilities and monitor if updates require more capabilities.

cugu

Catalogue all images of a Kubernetes cluster to multiple targets with Syft

ckotzbauer

Tern is a software composition analysis tool and Python library that generates a Software Bill of Materials for container images and Dockerfiles. The SBOM that Tern generates will give you a layer-by-...

tern-tools

Small tool to inform you about potential risks in project dependencies list

mbalabash

JavaScript & Node.js open-source SAST scanner. A static analyser for detecting most common malicious patterns 🔬.

NodeSecure

Supply-chain Levels for Software Artifacts

slsa-framework

Independent verification of binary packages - reproducible builds

kpcyrd

Experimental binary transparency for pacman with sigstore and rekor

kpcyrd

Detect and remediate misconfigurations and security risks across all your GitHub and GitLab assets

Legit-Labs