Language-agnostic SLSA provenance generation for Github Actions

Chainloop is an Open Source evidence store for your Software Supply Chain attestations, SBOMs, VEX, SARIF, CSAF files, QA reports, and more.

Macaron is an extensible supply-chain security analysis framework from Oracle Labs that supports a wide range of build systems and CI/CD services. It can be used to prevent supply chain attacks, detect malicious Python packages, or check conformance to frameworks, such as SLSA. Documentation:

A compilation of Software Supply Chain Security resources including initiatives, standards, regulations, organizations, vendors, tooling, books, articles and a plethora of learning resources from the web.

Template Go app repo with local test/lint/build/vulnerability check workflow, and on tag image test/build/release pipelines, with ko generative SBOM, cosign attestation, and SLSA build provenance

Developer-centric tool to secure your software supply chain.

A highly configurable build executor and observer designed to generate signed SLSA provenance attestations about build runs.

Github Action implementation of SLSA Provenance Generation

Container image provenance spec that allows tracing CVEs detected in registry images back to a CVE's source of origin.

GitHub Action to generate an attestation for the build provenance of a plugin ZIP file on WordPress.org

An opinionated Python package/application template repository, with SLSA and SBOM support built in, enabled for security scanners, code linters, typing, testing and code coverage monitoring, and release automation for reproducible builds.

Stream, Mutate and Sign Images with AWS Lambda and ECR

Automate vulnerability triage which prioritizes remediation over discovery

Project that demonstrates the implementation of SLSA L3 with Github Workflows and Sigstore. Bonus: binary authorization with Kyverno.

Samples showing how to secure the supply chain for Java applications.

SLSA level 3 action

Mattermost builder

Google Container Analysis data import utility, supports OSS vulnerability scanner reports, SLSA provenance and sigstore attestations.

Example project using SLSA 3 Generic Generator with GoReleaser

Azure DevOps Server development system segmentation best practices