supply-chain

Serenity-inspired Agent Skill for supply-chain bottleneck stock research

GUAC aggregates software security metadata into a high fidelity graph database.

A collection of reference Jupyter notebooks and demo AI/ML applications for enterprise use cases: marketing, pricing, supply chain, smart manufacturing, and more.

Audits Python environments, requirements files and dependency trees for known security vulnerabilities, and can automatically fix them

🏆Open Source Security Foundation (OpenSSF) Best Practices Badge (formerly Core Infrastructure Initiative (CII) Best Practices Badge)

Software Supply Chain Transparency Log

Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server

Endo is a distributed secure JavaScript sandbox, based on SES

in-toto is a framework to protect supply chain integrity.

Production-Grade ML System for Automated Unit of Measure Error Detection | 88-92% Accuracy | 94% Autonomy | KNIME Workflow

Go implementation of The Update Framework (TUF)

Packj stops :zap: Solarwinds-, ESLint-, and PyTorch-like attacks by flagging malicious/vulnerable open-source dependencies ("weak links") in your software supply-chain

Scans Software Bill of Materials (SBOMs) for security vulnerabilities

Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.

OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction. SBOM, SaaSBOM, HBOM, AI/ML-BOM, CBOM, OBOM, MBOM, VDR, and VEX

Common go library shared across sigstore services and clients

poutine, a supply chain vulnerability scanner for build pipelines