trustlock

trustlock A Git-native dependency admission controller. Evaluates trust signals on every dependency change. How it works trustlock runs as a Git pre-commit hook advisory mode and a CI check enforce mode: Advisory pre-commit: warns on violations, exits 0, advances the trusted baseline when all...

minimal

Small, hardened container images, free and MIT-licensed. Built from source with Chainguard's apko and Wolfi packages, rebuilt every six hours. Every image is cosign-signed, ships an SPDX SBOM attestation, and carries SLSA Level 3 build provenance. You can verify all of it without an account. 🌐...

slsa

SLSA "salsa" is Supply-chain Levels for Software Artifacts SLSA pronounced "salsa" is a security framework from source to service, giving anyone working with software a common language for increasing levels of software security and supply chain integrity. It’s how you get from safe enough to bein...

js-x-ray

!slsa...

scorecard

OpenSSF Scorecard 概述 什么是 Scorecard? 知名 Scorecard 用户 查看项目评分 Scorecard 公开数据 使用 Scorecard Scorecard GitHub Action Scorecard REST API Scorecard Badges Scorecard 命令行界面 前置条件 安装 身份验证 基本用法 检查项 默认 Scorecard 检查项 检查项详细文档（评分标准、风险与修复措施） Scorecard 检查项初学者指南 其他重要建议 双因素认证 2FA 评分 综合评分 贡献 报告问题 行为准则 为 Scorecard 做贡献...

slsa

SLSA（"salsa"）是软件工件供应链级别（Supply-chain Levels for Software Artifacts） SLSA（发音 “ salsa ”）是一个从源头到服务的安全框架，为所有使用软件的人提供了一种通用语言，用于提高软件安全和供应链完整性的各个级别。它让你从足够安全到在链条的任何环节都尽可能具有弹性。 了解 SLSA 参见 https://slsa.dev 了解 SLSA。 这个仓库里有什么？ 该仓库的主要内容是 spec/ 目录，该目录包含核心 SLSA 规范，以及 www/ 目录，该目录包含 slsa.dev 网站的源文件。在该目录的 README.m...

GO-2024-3116 vulnerabilities

Vulnerabilities for packages: cosign-fips, cosign, slsa-verifier, gh...

GO-2026-4348 vulnerabilities

Vulnerabilities for packages: falcoctl, kyverno, teleport-operator-fips, kubescape, skaffold, gitsign, cg, crossplane, reports-server, kyverno-policy-reporter-plugins-kyverno, gh, ratify-fips, slsa-verifier, spire-server-fips, ko, trivy-operator, zarf, goreleaser, ko-fips, falcoctl-fips,...

GO-2024-3166 vulnerabilities

Vulnerabilities for packages: falcoctl, kubescape, gitsign, wolfictl, slsa-verifier, gh, spire-server-fips, zarf, melange, falcoctl-fips, apko, policy-controller-fips, tekton-chains-fips, rekor, trivy, neuvector-sigstore-interface-fips, vexctl, sigstore-scaffolding, tkn, aactl, cosign-fips,...

GO-2024-2719 vulnerabilities

Vulnerabilities for packages: falcoctl, kubescape, skaffold, gitsign, wolfictl, slsa-verifier, spire-server-fips, zarf, ko, goreleaser, melange, ko-fips, falcoctl-fips, apko, policy-controller-fips, tekton-chains-fips, vexctl, tkn, aactl, flux-source-controller, chainctl,...

GO-2024-3116 vulnerabilities

Vulnerabilities for packages: cosign, gh, slsa-verifier...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: cloudflared, spire-server, vexctl, oauth2-proxy, terragrunt, flux-source-controller, fulcio, slsa-verifier, tekton-chains, flux-kustomize-controller, gitsign, tkn, argo-workflows, rekor, aactl, kubescape, dex, sops, kots, cosign...

GO-2026-5853 vulnerabilities

Vulnerabilities for packages: ratify, kubescape, flux-source-controller, kyverno, falcoctl, kyverno-notation-aws, slsa-verifier, skopeo, witness, tekton-chains, podman, gitsign, buildah, kots, zarf, undock, aactl...

GO-2026-5694 vulnerabilities

Vulnerabilities for packages: ratify, kubescape, teleport, kyverno, kyverno-notation-aws, crossplane, slsa-verifier, trivy, trivy-operator, policy-controller, zot, aactl...

GO-2026-4529 vulnerabilities

Vulnerabilities for packages: ratify, teleport, kyverno, kyverno-notation-aws, slsa-verifier, trivy-operator, trivy, tekton-chains, vexctl, skaffold, tkn, zot, ko, aactl...

GO-2026-5778 vulnerabilities

Vulnerabilities for packages: spire-server, falcoctl, crossplane, teleport, slsa-verifier, trivy-operator, tekton-chains, neuvector-sigstore-interface, gitsign, zarf, tkn, aactl, ratify, kubescape, goreleaser, tflint, kyverno, kyverno-notation-aws, policy-controller, ko...

GO-2023-2181 vulnerabilities

Vulnerabilities for packages: kubescape, spire-server, flux-source-controller, slsa-verifier, cosign, tekton-chains, apko, policy-controller, skaffold, melange, tkn, ko, aactl...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: syft, argocd-image-updater, docker-compose, witness, slsa-verifier, k9s, dagger, external-secrets-operator, pulumi-language-java, tkn, docker, glab, tw, flux-image-automation-controller, nuclei, crossplane-provider-family-aws, osv-scanner, argo-cd,...

GO-2026-4311 vulnerabilities

Vulnerabilities for packages: kubescape, sigstore-scaffolding, falcoctl, slsa-verifier, vexctl, cosign, skopeo, tekton-chains, witness, gitsign, kots, zarf, falco-no-driver, aactl...

GO-2026-5763 vulnerabilities

Vulnerabilities for packages: spire-server, docker-cli-buildx, crossplane, falcoctl, vexctl, trivy, skaffold, buildkitd, zot, teleport, sigstore-scaffolding, flux-source-controller, slsa-verifier, trivy-operator, tekton-chains, neuvector-sigstore-interface, gitsign, zarf, tkn, docker, aactl,...