Supply Chain Integrity Model

in-toto is a framework to protect supply chain integrity.

Software Supply Chain Transparency Log

Sigstore OIDC PKI

Code signing and transparency for containers and binaries

Python reference implementation of The Update Framework (TUF)

Open Source Package Analysis

Code-signing for npm packages

Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.

Scans SBOMs for vulnerabilities with Grype

An open-source tool for auditing your software supply chain stack for security compliance based on a new CIS Software Supply Chain benchmark.

GUAC aggregates software security metadata into a high fidelity graph database.

Deliver Go binaries as fast and easily as possible

Build OCI images from APK packages directly without Dockerfile

A reading list for software supply-chain security.

🥑 Language focused docker images, minus the operating system.

sigstore installation walkthrough, local

Generate SBOMs with gh CLI

Supply-chain Levels for Software Artifacts

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

Action for generating build provenance attestations for workflow artifacts

Pure-ruby implementation of sigstore verification

SLSA buildType for GitHub Actions

DevSecOps for Air Gap & Limited-Connection Systems. https://zarf.dev/