The S2C2F Project is a group working within the OpenSSF's Supply Chain Integrity Working Group formed to further develop and continuously improve the S2C2F guide which outlines and defines how to securely consume Open Source Software (OSS) dependencies into the developer’s workflow.
☆229May 26, 2025Updated 10 months ago
Alternatives and similar repositories for s2c2f
Users that are interested in s2c2f are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Open Source Software Secure Supply Chain Framework☆239Oct 28, 2022Updated 3 years ago
- OpenVEX Specification☆172Jan 16, 2026Updated 2 months ago
- Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact pro…☆522Updated this week
- in-toto Attestation Framework☆328Updated this week
- Supply-chain Levels for Software Artifacts☆1,839Apr 4, 2026Updated last week
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- Validate the SPDX SBOM against NTIA, CISA, and other minimum element requirements.☆85Mar 30, 2026Updated last week
- GUAC aggregates software security metadata into a high fidelity graph database.☆1,472Updated this week
- A place to systematically store software bill of materials (SBOM) documents.☆50Jun 1, 2023Updated 2 years ago
- Format agnostic SBOM tooling☆136Nov 20, 2025Updated 4 months ago
- Umbrella Repository Service for TUF☆65Updated this week
- Open Source Maturity Model☆16Apr 30, 2024Updated last year
- in-toto is a framework to protect supply chain integrity.☆990Updated this week
- ☆256Mar 31, 2026Updated last week
- A standard API specification for exchanging supply chain artifacts and intelligence☆106Mar 25, 2026Updated 2 weeks ago
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- A specification for signing methods and formats used by Secure Systems Lab projects.☆96Nov 10, 2025Updated 5 months ago
- Generate a score for your sbom to understand if it will actually be useful.☆240Aug 13, 2024Updated last year
- ☆149Updated this week
- Website and API for OpenSSF Scorecard☆28Apr 3, 2026Updated last week
- ☆25Nov 8, 2024Updated last year
- A utility to generate SPDX-compliant Bill of Materials manifests☆451Apr 3, 2026Updated last week
- Macaron is an extensible supply-chain security analysis framework from Oracle Labs that supports a wide range of build systems and CI/CD …☆190Updated this week
- Enrich SBOMs with data from third party services☆224Updated this week
- ☆102Sep 27, 2024Updated last year
- NordVPN Special Discount Offer • AdSave on top-rated NordVPN 1 or 2-year plans with secure browsing, privacy protection, and support for for all major platforms.
- ☆31Apr 1, 2026Updated last week
- Improve Software Bill of Materials (SBOM) tooling and training to encourage adoption☆112Feb 28, 2026Updated last month
- Collection of tools for analyzing open source packages.☆357Mar 9, 2026Updated last month
- OpenSSF Working Group on Securing Software Repositories☆128Dec 18, 2025Updated 3 months ago
- Verify provenance from SLSA compliant builders☆319Mar 9, 2026Updated last month
- automatically detect software supply chain smells and issues http://arxiv.org/pdf/2410.16049☆18Mar 13, 2026Updated 3 weeks ago
- The Best Practices for OSS Developers working group is dedicated to raising awareness and education of secure code best practices for ope…☆1,005Apr 3, 2026Updated last week
- OpenSSF Scorecard - Security health metrics for Open Source☆5,363Updated this week
- SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more☆542Apr 3, 2026Updated last week
- DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- vexctl is a tool to attest VEX impact statements☆45Mar 27, 2023Updated 3 years ago
- ☆80Dec 10, 2025Updated 4 months ago
- sigstore the hard way!☆118Aug 6, 2025Updated 8 months ago
- Machine-readable specification for the attestation of security-relevant data.☆73Mar 19, 2026Updated 3 weeks ago
- 🔐CNCF Security Technical Advisory Group -- secure access, policy control, privacy, auditing, explainability and more!☆2,260Dec 8, 2025Updated 4 months ago
- nginx image demo☆19Sep 11, 2023Updated 2 years ago
- A minimal specification for purl aka. a package "mostly universal" URL, join the discussion at https://gitter.im/package-url/Lobby☆1,007Updated this week