Docker · Supply Chain

Supply Chain

• sigstore/cosign on GitHub, opens in a new tab

  6.2Kstars

  Container signing, verification, and transparency log for OCI artifacts.

  Go·Apache License 2.0·active·3 days ago

• in-toto/in-toto on GitHub, opens in a new tab

  1Kstars

  Framework for supply chain attestations; underpins SLSA and cosign provenance.

  Python·Other·active·2 weeks ago

• in-toto/witness on GitHub, opens in a new tab

  546stars

  Generate and verify in-toto attestations across the build pipeline.

  Go·Apache License 2.0·active·15 hours ago

• sigstore/policy-controller on GitHub, opens in a new tab

  178stars

  Kubernetes admission controller enforcing cosign signatures on container images.

  Go·Other·active·6 days ago