tern-tools / tern
Tern is a software composition analysis tool and Python library that generates a Software Bill of Materials for container images and Dockerfiles. The SBOM that Tern generates will give you a layer-by-layer view of what's inside your container in a variety of formats including human-readable, JSON, HTML, SPDX and more.
☆984Updated last year
Alternatives and similar repositories for tern:
Users that are interested in tern are comparing it to the libraries listed below
- in-toto is a framework to protect supply chain integrity.☆923Updated this week
- Software Supply Chain Transparency Log☆956Updated this week
- OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reductio…☆396Updated this week
- A minimal specification for purl aka. a package "mostly universal" URL, join the discussion at https://gitter.im/package-url/Lobby☆767Updated this week
- Supply-chain Levels for Software Artifacts☆1,663Updated this week
- A utility to generate SPDX-compliant Bill of Materials manifests☆385Updated last week
- GUAC aggregates software security metadata into a high fidelity graph database.☆1,355Updated this week
- Support CI generation of SBOMs via golang tooling.☆424Updated 3 months ago
- A suite of tools to automate software compliance checks.☆1,739Updated this week
- A curated list of SBOM (Software Bill Of Materials) related tools, frameworks, blogs, podcasts, and articles☆519Updated 6 months ago
- FOSSology is an open source license compliance software system and toolkit. As a toolkit you can run license, copyright and export contr …☆860Updated this week
- Sigstore OIDC PKI☆719Updated this week
- Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact pro…☆472Updated this week
- CycloneDX CLI tool for SBOM analysis, merging, diffs and format conversions.☆357Updated 5 months ago
- Scans Software Bill of Materials (SBOMs) for security vulnerabilities☆565Updated last month
- Artifact Metadata API☆1,537Updated last week
- A repository with examples of CycloneDX BOMs (SBOM, SaaSBOM, OBOM, VEX, etc)☆193Updated 3 weeks ago
- Security risk analysis for Kubernetes resources☆1,321Updated this week
- ☆235Updated this week
- Platform AbstRaction for SECurity service☆484Updated 2 months ago
- ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party package…☆2,271Updated this week
- A service that analyzes docker images and scans for vulnerabilities☆1,585Updated 2 years ago
- Deploy-time Policy Enforcer for Kubernetes applications☆703Updated 3 weeks ago
- OpenSSF Security Tooling Working Group☆309Updated 11 months ago
- Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using e…☆2,451Updated this week
- CycloneDX Software Bill of Materials (SBOM) generator for Python projects and environments☆281Updated this week
- Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package manager…☆691Updated this week
- Generate a score for your sbom to understand if it will actually be useful.☆229Updated 8 months ago
- A reading list for software supply-chain security.☆362Updated 2 years ago
- OpenClarity is an open source tool built to enhance security and observability of cloud native applications and infrastructure☆1,399Updated last week