Bob Callaway

Container Signing

SigStore WebPKI

Rekor CLI application

Signing prototype

No description.

OSS-Fuzz - continuous fuzzing for open source software.

Relic is a service and a tool for adding digital signatures to operating system packages for Linux and Windows

Hello Ko App

No description.

The HTML Presentation Framework

No description.

Helm charts for sigstore project

RFC3161 Timestamp Authority

Protocol Buffer specifications

Cosign Github Action

Terraform modules for Sigstore cloud infrastructure

🏆Core Infrastructure Initiative Best Practices Badge

A Go client library for Sigstore

OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors

No description.

RE2 is a fast, safe, thread-friendly alternative to backtracking regular expression engines like those used in PCRE, Perl, and Python. It is a C++ library.

Scalable fuzzing infrastructure.

Abseil Common Libraries (C++)

Verify provenance from SLSA compliant builders

Supply chain security for ML

A Sigstore client in Python

A transparent, highly scalable and cryptographically verifiable data store.

Go library for building tile-based transparency logs (tlogs)

An implementation of the Static CT API based on Tessera.

java clients for sigstore

Keyless Git signing using Sigstore

🥑 Language focused docker images, minus the operating system.

Cryptographic and general-purpose routines for Golang Secure Systems Lab projects at NYU

Staging TUF repository for Sigstore trust root

Probers for sigstore infrastructure

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Signature Transparency Log designed for ease of use, low cost, and minimal maintenance

Pure-ruby implementation of sigstore verification

Pulumi GitHub Sync for sigstore

General sigstore community repo

Stuff to make standing up sigstore (esp. for testing) easier for e2e/integration testing.

Redis client Mock

Redis Go client

No description.

Tools & services used to help in the development flow of sigstore

Code-signing for npm packages

Build and distribute Linux packages from sources in an automatic, consistent and reproducible way #obs

Log monitor for Rekor to verify immutability and monitor entries

Sigstore documentation

Official Docker-maintained reusable GitHub Actions workflows

Search Rekor for entries

🔮 ✈️ to integrate OPA Gatekeeper's new ExternalData feature with cosign to determine whether the images are valid by verifying their signatures

Protect society by improving the security of open source software through direct maintainer engagement and expert analysis.

Plugin for Helm to integrate the sigstore ecosystem

No description.

Presents a Trillian gRPC facade for "frozen" transparency logs

Libraries and binaries for running witnesses for verifiable logs

No description.

Codebase for sigstore.dev

An experimental Rust crate for sigstore

No description.

Default community health files for the Sigstore organization.

sigstore Technical Advisory Council

A collection of reusable Github Actions workflows.

Conformance testing for Sigstore clients

🍻 Default formulae for the missing package manager for macOS (or Linux)

Security Scorecards - Security health metrics for Open Source

Auditing for TLS certificates (Go code)

Technical Advisory Council

No description.

A GitHub Action for sigstore-python

Builders and buildpacks designed to run on Google Cloud's container platforms

Sigstore Homebrew Tap

No description.

Zeitgeist: the language-agnostic dependency checker

A TUF repository and signing tool

Specification of sigstore's architecture in an IETF internet-draft format

Prometheus Busybox Docker base images

Codebase for sigstore.dev

Goreleaser image for Jenkins X

Konflux-test repository

Chalk allows you to follow code from development, through builds and into production.

Helm charts repository for the Cilium project

Docker image for Golang cross-compiling with CGO

BlueBuild's command line program that builds custom Fedora Atomic images based on your recipe.yml

contaiNERD CTL - Docker-compatible CLI for containerd, with support for Compose, Rootless, eStargz, OCIcrypt, IPFS, ...

k0s - The Zero Friction Kubernetes

Deliver Go binaries as fast and easily as possible

A modern runtime for JavaScript and TypeScript.

kubectl plugin for signing Kubernetes manifest YAML files with sigstore

Python reference implementation of The Update Framework (TUF)

Demo App for TAG App Delivery

Language-agnostic SLSA provenance generation for Github Actions

No description.

golang cross compiler with CGO

Educational Resources for Software Supply Chain Security

Open-source Android/Desktop remake of Civ V

Certificate transparency for Android and JVM

Cosign CircleCI orb. To learn more about cosign visit the GitHub repo

No description.

Docker CI scripts

Tools shared by several Istio repositories

eBPF-based Networking, Security, and Observability

Release infrastructure for Kubernetes and related components

No description.

Accelerating new GitHub Actions workflows

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

Bazel rules for building OCI containers

Making it easy to query APIs via SQL

Analyzer: checks whether HTTP response body is closed and a re-use of TCP connection is not blocked.

No description.

No description.

cookiecutter template for sigstore projects

sigstore maven plugin

No description.

A place to store some examples which use Trillian APIs to build things.

Dex website

Proposed OpenSSF Working Group on Securing Software Repositories

The Go programming language

Test repo for creating sigstore root metadata

GitHub App to set and enforce security policies

No description.

custom error page for nginx ingress controller

No description.

No description.

No description.

No description.

Supply Chain Security in Tekton Pipelines

A native implementation of the RPM file specification in Go

openapi specification object model analyzer

Golang implementation of parsing RPM packages

No description.

No description.

A program which ensures source code files have copyright license headers by scanning directory patterns recursively

Rekor website

Repository to store various monitors for upstream release sites

Rubygems sigstore signing plugin

🛡️ A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.

OpenID Connect Server & Client Library

Google HTTP Client Library for Java

Swagger 2.0 implementation for go

Cryptographic, immutable, append only software release ledger.

Tooling container to assemble CoreOS-like systems

OpenShift Cluster Console UI

OpenShift Documentation

Chef cookbook for managing NetApp E-Series storage systems

Chef cookbook for managing NetApp Clustered Data ONTAP

Python container images based on Red Hat Software Collections and intended for OpenShift and general usage, that provide a platform for building and running Python applications. Users can choose between Red Hat Enterprise Linux, Fedora, and CentOS based images.

Sources for SCL based Nginx container

A Fluent OpenStack Client Library for Java

No description.

No description.

No description.

OpenStack Cinder Puppet Module

Shared filesystem management project for OpenStack.

No description.

No description.

Horizon is a Django-based project aimed at providing a complete OpenStack Dashboard along with an extensible framework for building new dashboards from reusable components.

The Ruby cloud services library.