tern-tools / ternLinks
Tern is a software composition analysis tool and Python library that generates a Software Bill of Materials for container images and Dockerfiles. The SBOM that Tern generates will give you a layer-by-layer view of what's inside your container in a variety of formats including human-readable, JSON, HTML, SPDX and more.
☆990Updated last year
Alternatives and similar repositories for tern
Users that are interested in tern are comparing it to the libraries listed below
Sorting:
- in-toto is a framework to protect supply chain integrity.☆934Updated 3 weeks ago
- Software Supply Chain Transparency Log☆973Updated last week
- Artifact Metadata API☆1,540Updated 2 weeks ago
- Support CI generation of SBOMs via golang tooling.☆423Updated 5 months ago
- OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reductio…☆402Updated this week
- A utility to generate SPDX-compliant Bill of Materials manifests☆396Updated last week
- GUAC aggregates software security metadata into a high fidelity graph database.☆1,373Updated this week
- Deploy-time Policy Enforcer for Kubernetes applications☆704Updated 2 months ago
- Platform AbstRaction for SECurity service☆487Updated last month
- A minimal specification for purl aka. a package "mostly universal" URL, join the discussion at https://gitter.im/package-url/Lobby☆791Updated last week
- ☆237Updated last week
- CycloneDX CLI tool for SBOM analysis, merging, diffs and format conversions.☆372Updated this week
- FOSSology is an open source license compliance software system and toolkit. As a toolkit you can run license, copyright and export contr…☆870Updated last week
- Sigstore OIDC PKI☆731Updated last week
- A suite of tools to automate software compliance checks.☆1,769Updated this week
- Common go library shared across sigstore services and clients☆485Updated this week
- Supply-chain Levels for Software Artifacts☆1,676Updated this week
- A service that analyzes docker images and scans for vulnerabilities☆1,587Updated 2 years ago
- Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact pro…☆486Updated last week
- A curated list of SBOM (Software Bill Of Materials) related tools, frameworks, blogs, podcasts, and articles☆532Updated last month
- Python reference implementation of The Update Framework (TUF)☆1,665Updated last week
- The Update Framework specification☆389Updated last year
- A Python library to parse, validate and create SPDX documents.☆215Updated 2 months ago
- A reading list for software supply-chain security.☆363Updated 2 years ago
- Scans Software Bill of Materials (SBOMs) for security vulnerabilities☆570Updated 2 months ago
- Build OCI images from APK packages directly without Dockerfile☆1,379Updated this week
- in-toto Attestation Framework☆278Updated last week
- OpenClarity is an open source platform built to enhance security and observability of cloud native applications and infrastructure☆1,416Updated this week
- A compilation of resources in the software supply chain security domain, with emphasis on open source☆322Updated 2 years ago
- A security layer for Git repositories☆534Updated last week