sbom

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

🔎 ScanCode detects licenses, copyrights, package manifests & dependencies and more by scanning code ... to discover and inventory open source and third-party packages used in your code.

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

LunaSec - Open Source AppSec platform that automatically notifies you the next time vulnerabilities like Log4Shell or node-ipc happen. Track your dependencies and builds in a centralized service. Get started in one-click via our GitHub App or host it yourself. https://github.com/apps/lunatrace-by-lunasec/

A suite of tools to assist with reviewing Open Source Software dependencies.

The SBOM tool is a highly scalable and enterprise ready tool to create SPDX 2.2 compatible SBOMs for any variety of artifacts.

Tern is a software composition analysis tool and Python library that generates a Software Bill of Materials for container images and Dockerfiles. The SBOM that Tern generates will give you a layer-by-layer view of what's inside your container in a variety of formats including human-readable, JSON, HTML, SPDX and more.

KubeClarity is a tool for detection and management of Software Bill Of Materials (SBOM) and vulnerabilities of container images and filesystems

DevSecOps for Air Gap & Limited-Connection Systems. https://zarf.dev/

🎁 a wrapper around all package managers

Fully open-source security audit for project dependencies based on known vulnerabilities and advisories. Supports both local repos and container images. Integrates with various CI environments such as Azure Pipelines, CircleCI, Google CloudBuild. No server required!

A tool to automatically build a dependency graph and Software Bill of Materials (SBOM) for packages and arbitrary source code repositories.

The tool for checking and helping with compliance with the REUSE recommendations

Scans your project to determine what components you use

HummerRisk 是云原生安全检测平台。

Software Bill of Material (SBOM) standard designed for use in application security contexts and supply chain component analysis

Make production Rust binaries auditable

A curated list of SBOM (Software Bill Of Materials) related tools, frameworks, blogs, podcasts, and articles

Creates CycloneDX Software Bill of Materials (SBOM) from Maven projects

A utility to generate SPDX-compliant Bill of Materials manifests