146 matches found
trustlock
trustlock Git-родной контроллер допуска зависимостей. Оценивает сигналы доверия при каждом изменении зависимостей. Как это работает trustlock работает как Git-хук pre-commit рекомендательный режим и как проверка в CI режим принуждения: Рекомендательный pre-commit: предупреждает о нарушениях,...
minimal
Маленькие, укрепленные образы контейнеров, бесплатные и лицензированные по MIT. Собраны из исходного кода с помощью пакетов Chainguard's apko и Wolfi, пересобираются каждые шесть часов. Каждый образ подписан с помощью cosign, поставляется с аттестацией SPDX SBOM и имеет происхождение сборки SLSA...
slsa
SLSA "salsa" is Supply-chain Levels for Software Artifacts SLSA pronounced "salsa" is a security framework from source to service, giving anyone working with software a common language for increasing levels of software security and supply chain integrity. It’s how you get from safe enough to bein...
slsa
SLSA（“salsa”）は、ソフトウェアアーティファクトのサプライチェーンレベルです SLSA（発音は“salsa”）は、ソースからサービスまでのセキュリティフレームワークであり、ソフトウェアに関わるすべての人に、ソフトウェアセキュリティとサプライチェーンの整合性のレベルを高めるための共通言語を提供します。それは、チェーン内のどのリンクでも、安全な状態から可能な限り回復力のある状態へと移行する方法です。 SLSAについて学ぶ SLSAについて学ぶには、https://slsa.dev を参照してください。 このリポジトリの内容 このリポジトリの主要なコンテンツは、spec/...
scorecard
OpenSSF Scorecard...
GO-2024-3116 vulnerabilities
Vulnerabilities for packages: cosign, slsa-verifier, cosign-fips, gh...
GO-2026-4348 vulnerabilities
Vulnerabilities for packages: cg, rekor-fips, skaffold-fips, skaffold, flux-source-controller-fips, tekton-chains-fips, sigstore-scaffolding-fips, rekor, aactl, flux-source-controller, buildkitd-fips, neuvector-sigstore-interface, ratify, trivy-operator-fips, teleport-operator-fips, ko-fips, gh,...
GO-2024-3166 vulnerabilities
Vulnerabilities for packages: tekton-chains-fips, flux-source-controller-fips, sigstore-scaffolding-fips, rekor, aactl, flux-source-controller, apko, neuvector-sigstore-interface, gh, spire-server-fips, gitsign, policy-controller, tkn, melange, falcoctl-fips, kubescape, cosign, spire-server,...
GO-2024-2719 vulnerabilities
Vulnerabilities for packages: tekton-chains-fips, skaffold, aactl, flux-source-controller, apko, neuvector-sigstore-interface, ko-fips, spire-server-fips, gitsign, policy-controller, tkn, melange, falcoctl-fips, kubescape, goreleaser, spire-server, chainctl, ko, zot, policy-controller-fips,...
GO-2024-3116 vulnerabilities
Vulnerabilities for packages: slsa-verifier, gh, cosign...
GO-2023-2334 vulnerabilities
Vulnerabilities for packages: flux-kustomize-controller, sops, dex, slsa-verifier, fulcio, tekton-chains, oauth2-proxy, rekor, vexctl, gitsign, aactl, flux-source-controller, spire-server, terragrunt, cosign, kubescape, argo-workflows, kots, tkn, cloudflared...
GO-2026-5694 vulnerabilities
Vulnerabilities for packages: aactl, trivy, kyverno, kubescape, trivy-operator, teleport, kyverno-notation-aws, zot, crossplane, ratify, slsa-verifier, policy-controller...
GO-2026-5853 vulnerabilities
Vulnerabilities for packages: witness, gitsign, aactl, buildah, kubescape, kyverno, zarf, skopeo, tekton-chains, kots, flux-source-controller, undock, podman, kyverno-notation-aws, falcoctl, ratify, slsa-verifier...
GO-2023-2181 vulnerabilities
Vulnerabilities for packages: skaffold, aactl, kubescape, tekton-chains, ko, tkn, flux-source-controller, spire-server, cosign, slsa-verifier, melange, apko, policy-controller...
GO-2026-5778 vulnerabilities
Vulnerabilities for packages: tflint, kyverno, slsa-verifier, tekton-chains, trivy-operator, kyverno-notation-aws, crossplane, goreleaser, zarf, gitsign, aactl, ko, neuvector-sigstore-interface, spire-server, falcoctl, teleport, policy-controller, kubescape, tkn, ratify...
GO-2026-4529 vulnerabilities
Vulnerabilities for packages: skaffold, aactl, trivy, kyverno, tekton-chains, ko, tkn, trivy-operator, vexctl, kyverno-notation-aws, zot, teleport, ratify, slsa-verifier...
GO-2026-5013 vulnerabilities
Vulnerabilities for packages: buildah, step-issuer, nfpm, gatus, k9s, src, crossplane-provider-aws-ec2, act, rancher, prometheus-operator, go-discover, external-secrets-operator, steampipe, zarf, crossplane-provider-aws-firehose, pulumi-language-dotnet, gh, snyk-cli, trivy, ko,...
GO-2026-4311 vulnerabilities
Vulnerabilities for packages: witness, gitsign, aactl, kubescape, zarf, skopeo, tekton-chains, kots, vexctl, cosign, falcoctl, falco-no-driver, slsa-verifier, sigstore-scaffolding...
GO-2026-5763 vulnerabilities
Vulnerabilities for packages: skaffold, tflint, kyverno, slsa-verifier, sigstore-scaffolding, witness, tekton-chains, trivy-operator, vexctl, kyverno-notation-aws, goreleaser, crossplane, zarf, gitsign, aactl, gh, trivy, ko, flux-source-controller, neuvector-sigstore-interface, spire-server, zot,...