An open-source tool for auditing your software supply chain stack for security compliance based on a new CIS Software Supply Chain benchmark.
Trivy is a comprehensive security scanner designed to identify vulnerabilities and misconfigurations across container images, filesystems, and infrastructure as code files. It functions as a software composition analysis tool and an infrastructure security scanner, providing automated checks for CI/CD pipelines and cloud environments to ensure the integrity of the software supply chain. The tool distinguishes itself through a modular, plugin-based architecture that allows for the independent inspection of diverse targets. It utilizes a declarative policy engine to evaluate configurations agai
Syft is a software bill of materials generator, container image scanner, and software dependency catalog. It analyzes container images and filesystems to produce comprehensive inventories of installed packages and dependencies in standard formats. Additionally, it serves as a software attestation tool and an SBOM format converter. The project distinguishes itself through the ability to create cryptographically signed attestations for software inventories to ensure provenance and integrity. It also provides the capability to transform software bills of materials between different industry sche
preflight helps you verify scripts and executables to mitigate chain of supply attacks such as the recent Codecov hack.
The main features of spectralops/preflight are: DevOps Security, Supply Chain Security.
Open-source alternatives to spectralops/preflight include: aquasecurity/chain-bench — An open-source tool for auditing your software supply chain stack for security compliance based on a new CIS Software… aquasecurity/trivy — Trivy is a comprehensive security scanner designed to identify vulnerabilities and misconfigurations across container… baalmor/cve-ape — A CVE scanner which can process a pkglist. deislabs/ratify — Artifact Ratification Framework (CNCF Sandbox). denysvuika/supply-chain-inspector — A standalone, zero-dependency Node.js script for supply chain security analysis of npm dependencies. anchore/syft — Syft is a software bill of materials generator, container image scanner, and software dependency catalog. It analyzes…
