|Project Name||Stars||Downloads||Repos Using This||Packages Using This||Most Recent Commit||Total Releases||Latest Release||Open Issues||License||Language|
|X64dbg||40,056||13 days ago||523||other||C++|
|An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.|
|Trivy||16,694||25||16 hours ago||176||September 16, 2022||386||apache-2.0||Go|
|Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more|
|Gitleaks||12,050||2 days ago||97||mit||Go|
|Protect and discover secrets using Gitleaks 🔑|
|Personal Security Checklist||10,873||5 days ago||25||other|
|🔒 A compiled checklist of 300+ tips for protecting digital security and privacy in 2022|
|Trufflehog||10,696||6||2||a day ago||42||April 28, 2021||126||agpl-3.0||Go|
|Find credentials all over the place|
|Zaproxy||10,635||3||4||20 hours ago||8||December 11, 2021||744||apache-2.0||Java|
|The OWASP ZAP core project|
|Vuls||9,860||a day ago||142||September 02, 2022||80||gpl-3.0||Go|
|Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices|
|Rustscan||9,432||20 days ago||17||April 27, 2022||117||gpl-3.0||Rust|
|🤖 The Modern Port Scanner 🤖|
|Scapy||8,557||814||150||16 hours ago||22||April 19, 2021||118||gpl-2.0||Python|
|Scapy: the Python-based interactive packet manipulation program & library. Supports Python 2 & Python 3.|
|Fail2ban||8,029||21 hours ago||1||August 14, 2018||217||other||Python|
|Daemon to ban hosts that cause multiple authentication errors|
Supply chain Levels for Software Artifacts, or SLSA (salsa), is a security framework, a check-list of standards and controls to prevent tampering, improve integrity, and secure packages and infrastructure in your projects, businesses or enterprises.
SLSA defines an incrementally adoptable set of levels which are defined in terms of increasing compliance and assurance. SLSA levels are like a common language to talk about how secure software, supply chains and their component parts really are.
Provenance is information, or metadata, about how a software artifact was created. This could include information about what source code, build system, and build steps were used, as well as who and why the build was initiated. Provenance can be used to determine the authenticity and trustworthiness of software artifacts that you use.
As part of the framework, SLSA defines a provenance format which can be used to hold this metadata.
slsa-github-generator is a set of tools for generation of SLSA3+ provenance for native GitHub projects. It allows projects to generate SLSA provenance safely and accurately using GitHub Actions.
Specifically, this repository contains tools for generating non-forgeable SLSA provenance on GitHub that meets the build and provenance requirements for SLSA level 3 and above.
While slsa-github-generator can help you achieve SLSA level 3, use of the provided GitHub Actions reusable workflows only is not sufficient to meet all of the requirements at SLSA level 3. Specifically, the source requirements are not covered by these workflows and must be handled explicitly to meet all requirements at SLSA level 3+.
The project roadmap is tracked via milestones. You can track progress and open issues via the milestones page. Each milestone includes a description of what is being worked on and a rough timeline for completion.
Below we describe the various builders and generators in this repository. They let you build and / or generate non-forgeable provenance using a trusted / isolated re-usable workflow. You can read up on the design in our technical design document.
At present, the GitHub Actions provided in this repository as builders and generators MUST be referenced
by tag in order for the
slsa-verifier to be able to verify the ref of the trusted builder/generator's
reusable workflow. It also needs to be referred as
@vX.Y.Z, because the build will fail if you reference it via a shorter tag like
This is contrary to the GitHub best practice for third-party actions which recommends referencing by digest, but intentional due to limits in GitHub Actions. The desire to be able to verify reusable workflows pinned by hash, and the reasons for the current status, are tracked as Issue #12 in the slsa-verifier project.
For guidance on how to configure renovate see RENOVATE.md.
Builders build and generate provenance. They let you meet the build and provenance requirements for SLSA Level 3 and above.
Builders are able to report the commands used to generate your artifact in the provenance.
This repository hosts the following builders:
If you would rather build your project yourself, use the generators instead as explained in the next section.
Provenance-only generators let you build your artifact, and only generate provenance for you. They let you meet the provenance requirements for SLSA Level 3.
Generators create an attestation to a software artifact coming from your repository.
Generators are not able to report the commands used to generate your artifact in the provenance.
This repository hosts the following generators:
To verify the provenance, use the github.com/slsa-framework/slsa-verifier project.
To install the verifier, see slsa-framework/slsa-verifier#installation.
The inputs of the verifier are described in slsa-framework/slsa-verifier#available-options.
A command line example is provided in slsa-framework/slsa-verifier#example.
The initial technical design was described in the blog post "Improving software supply chain security with tamper-proof builds".
For a more in-depth technical dive, read the SPECIFICATIONS.md.
The format of the provenance is available in PROVENANCE_FORMAT.md.
Please see the Contributor Guide for more info.