Software Supply Chain Security

13 repos

Tools and infrastructure for securing the software supply chain, from code provenance and artifact signing to dependency analysis and security scoring. The cluster centers on establishing trust and transparency in open-source software through mechanisms like code signing (Sigstore), artifact transparency logs (Rekor), and automated security assessments (OpenSSF Scorecard). Most repos are written in Go with supporting JavaScript and Python tooling, spanning both CLI utilities and web-based frontends for auditing and validating software artifacts.

Go · 6

JavaScript · 2

Python · 2

Makefile · 1

Shell · 1

TypeScript · 1

supply-chain ·6,721

security ·6,721

software-supply-chain ·1,958

software-supply-chain-security ·1,958

sbom ·1,583

graph ·1,540

in-toto ·1,540

cyclonedx ·1,540

cyclonedx-sbom ·1,540

attestations ·1,540

Related clusters

Secret Detection & Data Leak Prevention34 Cluster 4371657 Cluster 4363909 Cluster 4386198 Cluster 4621733 GitHub Actions for Google Cloud37

sigstore/rekor

Software Supply Chain Transparency Log

1,205

2,205 commits

sigstore/model-transparency

Supply chain security for ML

Python

244

467 commits

sigstore/sigstore

Common go library shared across sigstore services and clients

533

1,907 commits

sigstore/rekor-tiles

Signature Transparency Log designed for ease of use, low cost, and minimal maintenance

602 commits

sigstore/sigstore-js

Code-signing for npm packages

TypeScript

182

1,283 commits

mindersec/minder

Software Supply Chain Security Platform

418

5,778 commits

in-toto/in-toto

in-toto is a framework to protect supply chain integrity.

Python

1,035

1,345 commits

GautamTalksDev/mcp-pin

Tool-integrity pinning for MCP. Pin what your agent approved; block it when it changes.

JavaScript

33 commits

ossf/scorecard-action

Official GitHub Action for OpenSSF Scorecard.

417

642 commits

opscart/docker-security-practical-guide

A hands-on lab toolkit for container security, from CIS-benchmark fundamentals to architectural…

Shell

17 commits

endojs/endo

Endo is a distributed secure JavaScript sandbox, based on SES

JavaScript

1,054

7,179 commits

guacsec/guac

GUAC aggregates software security metadata into a high fidelity graph database.

1,540

2,412 commits

sigstore/root-signing

TUF repository for Sigstore trust root

Makefile

133

2,303 commits