cyclonedx · GitHub Topics

grype 是一款针对容器镜像和文件系统的漏洞扫描器

containers 安全 vulnerability Docker Go static-analysis container-image 工具 oci cyclonedx vulnerabilities Hacktoberfest openvex vex

Go 10 k

2 天前

anchore / syft

syft 是一个 CLI 工具和 Go 库，用于从容器镜像和文件系统生成软件物料清单（SBOM）

containers Docker Go static-analysis 工具 oci sbom spdx cyclonedx Hacktoberfest

Go 7.2 k

2 天前

DependencyTrack / dependency-track

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

Java 3.1 k

1 天前

aboutcode-org / scancode-toolkit

🔍 ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet project https://nl...

license copyright packages 依赖管理 spdx provenance license-scan licensing spdx-licenses open-source-licensing license-checking software-composition-analysis purl package-url sbom sca cyclonedx dependency-graph

Python 2.3 k

2 天前

oss-review-toolkit / ort

A suite of tools to automate software compliance checks.

Package manager 依赖管理 dependency-graph license copyright spdx compliance license-management sbom sbom-generator open-source-licensing ospo cyclonedx sca Hacktoberfest cra dora

Kotlin 1.76 k

1 天前

guacsec / guac

GUAC aggregates software security metadata into a high fidelity graph database.

安全 software-supply-chain software-supply-chain-security supply-chain-security attestations graph sbom cyclonedx spdx vex vulnerability vulnerability-management

Go 1.37 k

4 天前

owasp-dep-scan / dep-scan

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container ima...

vulnerability-scanners Common Vulnerabilities and Exposures (CVE)dependency-analysis containers sbom sca compliance cyclonedx devsecops 安全 vex supply-chain-security

Python 1.12 k

19 天前

XmirrorSecurity / OpenSCA-cli

OpenSCA is an open source software supply chain security solution that supports the detection of open source dependencies, vulnerabilities and license compliance with a widely noticed accuracy by the ...

sca devsecops 安全 sbom software-composition-analysis software-supply-chain software-supply-chain-security static-analysis vulnerabilities cyclonedx spdx

Go 1.08 k

1 个月前

package-url / purl-spec

A minimal specification for purl aka. a package "mostly universal" URL, join the discussion at https://gitter.im/package-url/Lobby

purl package-url package url cyclonedx 依赖管理 package-management sbom spdx

786

5 天前

CycloneDX / cdxgen

Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission t...

bom sca cyclonedx sbom Docker oci containers owasp package-url purl

JavaScript 708

3 天前

ARPSyndicate / puncia

Panthera(P.)uncia - Official CLI utility for Osprey Vision, Subdomain Center & Exploit Observer.

Exploit subdomain sbom vulnerability cyclonedx

Python 648

18 天前

devops-kung-fu / bomber

Scans Software Bill of Materials (SBOMs) for security vulnerabilities

spdx cyclonedx sbom Open Source vulnerability-scanners syft devsecops Go 安全 security-automation

Go 572

3 个月前

kdeldycke / meta-package-manager

🎁 wraps all package managers with a unifying CLI

npm pip Homebrew macOS mac-app-store ruby-gem Linux Windows apt Yarn snap Steam xbar Package manager sbom package-url cyclonedx spdx

Python 511

5 天前

chainloop-dev / chainloop

Evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

compliance cyclonedx devsecops sbom 安全 spdx supply-chain-security license open-source-licensing ospo attestation

Go 463

5 天前

CycloneDX / specification

#计算机科学#OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction. SBOM, SaaSBOM, HBOM, AI/ML-BOM, CBOM, OBOM, MBOM, VDR, and V...

bill-of-materials bom 软件 spdx license sbom cyclonedx owasp standard specification vex 机器学习

XSLT 401

4 天前

owasp-dep-scan / blint

BLint is a Binary Linter to check the security properties, and capabilities in your executables. Since v2, blint is also an SBOM generator for binaries.

binary Fuzzing/Fuzz testing Malware cyclonedx sbom supply-chain-security

Python 380

8 天前

CycloneDX / cyclonedx-cli

CycloneDX CLI tool for SBOM analysis, merging, diffs and format conversions.

bom bill-of-materials purl package-url sbom cyclonedx spdx owasp sbom-generator vex Hacktoberfest

C# 368

7 个月前

CycloneDX / cyclonedx-maven-plugin

Creates CycloneDX Software Bill of Materials (SBOM) from Maven projects

bom spdx Maven maven-plugin bill-of-materials package-url purl sbom cyclonedx owasp sbom-generator vex

Java 324