in-toto/witness
Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.
A star delta has been computed for 63,087 of 63,708 tracked repositories in this period, and only those can be ranked in it.
A repository missing here has not been measured far enough back yet. That does not mean it did not move.
Star counts measured between 02:37 and 00:56 (BKK).
Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.
Software Supply Chain Transparency Log
Audits Python environments, requirements files and dependency trees for known security vulnerabilities, and can automatically fix them
A股/港股/美股 卡脖子选股 Skill，基于 Serenity 供应链瓶颈理论 | Claude Code / Codex 通用智能体可用，零依赖
Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server
GUAC aggregates software security metadata into a high fidelity graph database.
ReARM - Release Governance Platform
Go implementation of The Update Framework (TUF)
Common go library shared across sigstore services and clients
Rust's extended standard library: simplicity, performance and supply chain security for everyone.
A Sigstore client written in Python
Software Supply Chain Security Platform
A tool to create, transform and attest VEX metadata
Trusted builds made easy! A cloud-native software factory for building, testing, and releasing trusted software artifacts
Trusted Computing based services supporting TPM provisioning and supply chain validation concepts. #nsacyber
Independent verification of binary packages - Reproducible Builds
Author, generate, validate and govern AI agent rules, skills, plugins and MCP configuration across 52 coding assistants. Review with verified model evidence, evaluate skills, lock and sign dependencies, and publish bundles. CLI, MCP server and Go API.
A multi-platform CI/CD vulnerability detection and attack automation tool for identifying security weaknesses in pipeline configurations.
Endo is a distributed secure JavaScript sandbox, based on SES
Rebuild the JavaScript GitHub Actions your workflows pin and check that their committed dist matches the source.
poutine, a supply chain vulnerability scanner for build pipelines
Official GitHub Action for OpenSSF Scorecard.
Malicious package & supply-chain intelligence
我把 Serenity 的研究方法做成了一个 AI Skill：输入任意一只 A股、港股、美股代码，它会告诉你这家公司是不是真卡点、值不值得深挖、估值还有多少空间，以及出现什么情况说明看错了。
🏆Open Source Security Foundation (OpenSSF) Best Practices Badge (formerly Core Infrastructure Initiative (CII) Best Practices Badge)
That's all 25 repositories in this period.