NPM Provenance Public Beta

• packj

  38 614 7.2 Python

  Packj stops :zap: Solarwinds-, ESLint-, and PyTorch-like attacks by flagging malicious/vulnerable open-source dependencies ("weak links") in your software supply-chain

  

Great work! This provenance check is going to be very valuable for enforcing supply-chain security. We are working on adding support to check for provenance in Packj.

1. https://github.com/ossillate-inc/packj flags risky/malicious NPM/PyPI/Ruby dependencies

• dsse

  3 57 0.6 Jupyter Notebook

  A specification for signing methods and formats used by Secure Systems Lab projects.

  

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• attestation

  3 187 8.7 Go

  in-toto Attestation Framework

  

• root-signing

  1 75 9.5 Go
  

caveat, I am from the sigstore project.

GitLab are currently working with sigstore community to rig in their CI/CD as well and the root of CA of sigstore is community created and owned. This means any provider can trade an ODIC ID token for a sigstore certificate.

https://github.com/sigstore/root-signing

• fulcio

  6 600 9.6 Go

  Sigstore OIDC PKI

  

untrue.

The Root CA is generated by the sigstore community (five folks, two from academia) this is what is used for the trust root for the signing. Right now github exchanges a OIDC token for a sigstore root chained cert.

GitLab are currently adding themselves, to have the same capability.

https://github.com/sigstore/fulcio/pull/1097

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

Suggest a related project