tern-tools / tern
Tern is a software composition analysis tool and Python library that generates a Software Bill of Materials for container images and Dockerfiles. The SBOM that Tern generates will give you a layer-by-layer view of what's inside your container in a variety of formats including human-readable, JSON, HTML, SPDX and more.
☆979Updated last year
Alternatives and similar repositories for tern:
Users that are interested in tern are comparing it to the libraries listed below
- in-toto is a framework to protect supply chain integrity.☆905Updated this week
- Software Supply Chain Transparency Log☆940Updated this week
- Supply-chain Levels for Software Artifacts☆1,626Updated this week
- A minimal specification for purl aka. a package "mostly universal" URL, join the discussion at https://gitter.im/package-url/Lobby☆743Updated this week
- Support CI generation of SBOMs via golang tooling.☆422Updated 2 months ago
- Artifact Metadata API☆1,531Updated last week
- Deploy-time Policy Enforcer for Kubernetes applications☆703Updated last month
- Sigstore OIDC PKI☆695Updated this week
- GUAC aggregates software security metadata into a high fidelity graph database.☆1,338Updated this week
- OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reductio…☆389Updated this week
- Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package manager…☆652Updated this week
- A curated list of SBOM (Software Bill Of Materials) related tools, frameworks, blogs, podcasts, and articles☆510Updated 4 months ago
- Keyless Git signing using Sigstore☆977Updated this week
- A service that analyzes docker images and scans for vulnerabilities☆1,588Updated 2 years ago
- A utility to generate SPDX-compliant Bill of Materials manifests☆377Updated last week
- Common go library shared across sigstore services and clients☆475Updated this week
- ☆232Updated last week
- A suite of tools to automate software compliance checks.☆1,697Updated this week
- CyberArk Conjur automatically secures secrets used by privileged users and machine identities☆810Updated last month
- Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact pro…☆431Updated this week
- Scans Software Bill of Materials (SBOMs) for security vulnerabilities☆555Updated this week
- Language-agnostic SLSA provenance generation for Github Actions☆454Updated last week
- Code signing and transparency for containers and binaries☆4,791Updated this week
- An admission controller that integrates Container Image Signature Verification into a Kubernetes cluster☆450Updated this week
- CycloneDX CLI tool for SBOM analysis, merging, diffs and format conversions.☆343Updated 4 months ago
- Platform AbstRaction for SECurity service☆480Updated 2 weeks ago
- FOSSology is an open source license compliance software system and toolkit. As a toolkit you can run license, copyright and export contr…☆840Updated this week
- The SPIFFE Project☆1,546Updated last week
- The SBOM tool is a highly scalable and enterprise ready tool to create SPDX 2.2 compatible SBOMs for any variety of artifacts.☆1,737Updated this week
- umoci modifies Open Container images☆773Updated 3 months ago