![:octocat: :octocat:](https://github.githubassets.com/images/icons/emoji/octocat.png)
![:octocat: :octocat:](https://github.githubassets.com/images/icons/emoji/octocat.png)
- GitHub Staff
- Washington, D.C.
-
09:23
(UTC -04:00) - https://pwelch.dev
- @[email protected]
Supply Chain Security
in-toto is a framework to protect supply chain integrity.
Code signing and transparency for containers and binaries
Python reference implementation of The Update Framework (TUF)
Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.
Scans SBOMs for vulnerabilities with Grype
An open-source tool for auditing your software supply chain stack for security compliance based on a new CIS Software Supply Chain benchmark.
GUAC aggregates software security metadata into a high fidelity graph database.
Deliver Go binaries as fast and easily as possible
Build OCI images from APK packages directly without Dockerfile
A reading list for software supply-chain security.
π₯ Language focused docker images, minus the operating system.
sigstore installation walkthrough, local
Supply-chain Levels for Software Artifacts
CLI tool and library for generating a Software Bill of Materials from container images and filesystems
Action for generating build provenance attestations for workflow artifacts
Pure-ruby implementation of sigstore verification
DevSecOps for Air Gap & Limited-Connection Systems. https://zarf.dev/