Entry
Appears in 4 awesome lists
An open-source project for improving software supply chain security that empowers developers to securely sign and verify software artifacts using ephemeral keys, eliminating the need for long-lived key management. Sigstore combines Cosign (signing client), Fulcio (certificate authority bound to…
Section: Supply Chain Security · sigstore is a set of free to use and open source tools, including fulcio, cosign and rekor, handling digital signing, verification and checks for provenance needed to make it safer to distribute and use open source software.
Section: Air-Gap-Specific Failure Modes · Cosign, Rekor, Fulcio — the modern supply-chain-security toolkit that has become table stakes in accredited environments.
Section: Supply Chain Security · An open-source project for improving software supply chain security that empowers developers to securely sign and verify software artifacts using ephemeral keys, eliminating the need for long-lived key management. Sigstore combines Cosign (signing client), Fulcio (certificate authority bound to…
Section: Security · Signing, verification and provenance for software artifacts. oss
A Simple and Comprehensive Vulnerability Scanner for Containers and other Artifacts, Suitable for CI. Trivy detects vulnerabilities of OS packages (Alpine, RHEL, CentOS, etc.) and application dependencies (Bundler, Composer, npm, yarn, etc.). Checks containers and filesystems.
A CLI tool and library for generating Software Bills of Materials (SBOMs) from container images and filesystems, supporting CycloneDX and SPDX formats.
Vulnerability scanner for container images and filesystems. Developed by Anchore, it scans container images, directories, and archives for known vulnerabilities. Supports multiple image formats, SBOM integration, and VEX (Vulnerability Exploitability eXchange) for accurate vulnerability…
Tool for detecting and preventing hardcoded secrets like passwords, api keys, and tokens in git repos.
SCAR - a browser extension helping developers evaluate open source packages before picking them.
A software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.
A CNCF-graduated framework developed at NYU Tandon that protects the integrity of the software supply chain by verifying each task in the chain is carried out as planned, by authorized personnel only, and that the product is not tampered with in transit. in-toto uses signed layouts and link…
State of DevSecOps (2025) - Focuses on the adoption of DevSecOps practices within the United States Department of Defense. Key metrics reveal that over 60 percent of surveyed organizations face similar exposures, a key finding is the Air Force's launch of a new software directorate, highlighting a…