sigstore/community
General sigstore community repo
Stars: 45Forks: 56Updated Oct 14, 2026
Software supply chain security
Tools and research for signing, dependencies, builds, and provenance.
Bookmarks for reference; inclusion does not indicate testing or a recommendation.
Repositories
Filters need JavaScript. You can browse the repositories and pages below.
Page 1. 26 repositories in this topic.
Go
securebuildhq/securebuild
No description provided.
Stars: 28Forks: 3Updated Oct 16, 2026
Python
AdnaneKhan/ActionsTOCTOU
Example repository for GitHub Actions Time of Check to Time of Use (TOCTOU vulnerabilities)
Stars: 44Forks: 6Updated Jul 4, 2026
actionsbugbounty
TypeScript
AdnaneKhan/Cacheract
GitHub Actions Cache Native Malware - for Educational and Research Purposes only.
Stars: 173Forks: 12Updated Sep 25, 2026
actionscache-poisoning
Python
pulp/pulpcore
Pulp 3 pulpcore package https://pypi.org/project/pulpcore/
Stars: 611Forks: 175Updated Oct 18, 2026
Python
SocketDev/socket-basics
Socket's tool for running SAST, Secrets, and Container Scaning
Stars: 14Forks: 8Updated Sep 19, 2026
JavaScript
LavaMoat/LavaMoat
tools for sandboxing your dependency graph
Stars: 1,240Forks: 84Updated Oct 13, 2026
Solidity
ASSERT-KTH/sb-heists
scientific dataset of smart contract exploits see paper http://arxiv.org/pdf/2501.04600
Stars: 14Forks: 7Updated Jun 2, 2026
Go
reproducible-containers/diffoci
diff for Docker and OCI container images
Stars: 622Forks: 15Updated Oct 5, 2026
JavaScript
jfrog/evidence-extractor
Free DSSE Attestation Online Decoder Tool
Stars: 15Forks: 3Updated Jul 26, 2026
attestationattestations
TypeScript
sigstore/sigstore-js
Code-signing for npm packages
Stars: 185Forks: 48Updated Oct 14, 2026
codesigningjavascript
Go
google/oss-rebuild
Securing open-source package ecosystems by originating, validating, and augmenting build attestations.
Stars: 716Forks: 71Updated Oct 16, 2026
Go
ossf/malicious-packages
A repository of reports of malicious packages identified in Open Source package repositories, consumable via the Open Source Vulnerability (OSV) format.
Stars: 630Forks: 163Updated Oct 18, 2026
Go
package-url/packageurl-go
Go implementation of the package url spec
Stars: 75Forks: 65Updated Oct 6, 2026
gogo-library
Go
sigstore/sigstore
Common go library shared across sigstore services and clients
Stars: 539Forks: 160Updated Oct 14, 2026
cosigngo
Go
docker/docker-credential-helpers
Programs to keep Docker login credentials safe by storing in platform keystores
Stars: 1,322Forks: 196Updated Oct 15, 2026
Go
sigstore/sigstore-go
Go library for Sigstore signing and verification
Stars: 95Forks: 57Updated Oct 16, 2026
gogolang
Go
jfrog/jfrog-client-go
All go clients for JFrog products
Stars: 274Forks: 174Updated Oct 14, 2026
Python
SocketDev/socket-sdk-python
Python SDK for the Socket API
Stars: 13Forks: 4Updated Sep 9, 2026
Go
guacsec/guac
GUAC aggregates software security metadata into a high fidelity graph database.
Stars: 1,557Forks: 222Updated Oct 15, 2026
attestationscyclonedx
Python
pypa/gh-action-pypi-publish
The blessed :octocat: GitHub Action, for publishing your :package: distribution files to PyPI, the tokenless way: https://github.com/marketplace/actions/pypi-publish
Stars: 1,184Forks: 122Updated Oct 15, 2026
actionsgithub-action
Go
DataDog/supply-chain-firewall
Supply Chain Firewall (SCFW) is a tool for preventing the installation of malicious npm and PyPI packages :fire:
Stars: 398Forks: 28Updated Oct 12, 2026
malicious-packagesnpm
JavaScript
bdehamer/attest-demo
Artifact Attestation Demo
Stars: 5Forks: 6Updated Oct 18, 2026
JavaScript
npm/cli
the package manager for JavaScript
Stars: 10,193Forks: 4,875Updated Oct 17, 2026
javascriptnodejs
Go
safedep/vet
Protect against malicious open source packages 🤖
Stars: 1,114Forks: 115Updated Oct 17, 2026
devsecopsgolang
TypeScriptArchived
npm/provenance
Details on npm provenance
Stars: 13Forks: 1Updated Jun 30, 2025