awesome-software-supply-chain-security

A compilation of resources in the software supply chain security domain, with emphasis on open source.

awesome-software-supply-chain-security

About this list

There is no prescribed taxonomy for this domain. This list will necessarily have some overlap with disciplines and categories such as DevSecOps, SAST, SCA and more.

The supply-chain-synthesis repo offers a long-form read on why that's the case, plus helpful pointers to understand and navigate it as it evolves.

For awesome-software-supply-chain-security we take the following high-level approach: different actors in the supply chain contribute attestations to the elements represented in the chain.

In this process-centric view, attestations are emitted, augmented (e.g., during composition) and verified.

Another way to look at this was described here by Josh Bressers, and here's a narrative example in the wild from Spotify

Using this lens we can identify a large group of "subjects" (dependencies), distinct categories of "facts" (licenses or vulnerabilities) and the specific role of identity, provenance and build systems. This is the rationale behind the current headings, which are expected to evolve with the domain.

Other examples of the ongoing process to define the domain include Add Bad Design as a supply chain scenario · Issue #249 · slsa-framework/slsa and How does SLSA fit into broader supply chain security? · Issue #276 · slsa-framework/slsa. Check out this tweet from Aeva Black with Dan Lorenc for another in-a-pinch view of a couple key projects.

Dependency intelligence

This section includes: package management, library management, dependency management, vendored dependency management, by-hash searches, package, library and dependency naming, library behavior labeling, library publishing, registries and repositories, publishing gates and scans, dependency lifecycle.

Open Source Insights
package-url/purl-spec: A minimal specification for purl aka. a package "mostly universal" URL, join the discussion at https://gitter.im/package-url/Lobby
Online services that help understand what a specific dependency is, or at least whether it's known (usually feeding it a package identifier, such as purl, CPE or another form of ecosystem:name:version, or alternatively via hash):
- NSRL: hashes for COTS software, well-integrated in tooling from sleuthkit/hfind to nsrllookup
- A source that can be queried via a public API (HTTP and DNS!) and can be more open source-aware is CIRCL hashlookup
- Repology has legendary coverage for Linux packages across multiple distribution; its repology-updater and other infrastructure pieces are open source. It provides an updater for WikiData which also has properties of interest for the supply chain security domain.
- Debian's external repositories metadata
- Tidelift's libraries.io provides an API and supports over 30 package ecosystems (and several useful open source tools)
- WhiteSource's Unified Agent also offers some sophisticated file matching abilities
- The Software Heritage Project has massive ingestion capabilities and offers an API which can efficiently check whether a hash is known, and provide certain information on the file if so
  - Also see swh scanner CLI
- hashdd - Known Good Cryptographic Hashes
- ClearlyDefined provides licensing information for open source components, given their coordinates
- LGTM - Code Analysis Platform to Find and Prevent Vulnerabilities allows manually searching by GitHub repo
- Binary Transparency directory offers an API that allows to search packages by hash and other attributes
  - A somehow related read is the second half of How Cloudflare verifies the code WhatsApp Web serves to users
  - And Subresource Integrity
  - Not to be confused with the legendary read on Binary Transparency
For inputs acquired e.g., via curl:
deepfence/ThreatMapper: 🔥 🔥 Open source cloud native security observability platform. Linux, K8s, AWS Fargate and more. 🔥 🔥
dependency-check
ossf/package-analysis: Open Source Package Analysis and ossf/package-feeds: Feed parsing for language package manager updates
- Related: Introducing Package Analysis: Scanning open source packages for malicious behavior
- Also Argo Security Automation with OSS-Fuzz, Improving Security by Fuzzing the CNCF landscape and google/oss-fuzz: OSS-Fuzz - continuous fuzzing for open source software.
- And ClusterFuzzLite
- For Node.js: CodeIntelligenceTesting/jazzer.js: Coverage-guided, in-process fuzzing for the Node.js
- Also, although arguably more in the realm of application observability, IntelLabs/control-flag: A system to flag anomalous source code expressions by learning typical expressions from training data
cugu/gocap: List your dependencies capabilities and monitor if updates require more capabilities.
Checkmarx/chainalert-github-action: scans popular packages and alerts in cases there is suspicion of an account takeover
Open Source Security Foundation (OpenSSF) Alpha-Omega Project
Socket - Find and compare millions of open source packages, focused on JavaScript
diffoscope: in-depth comparison of files, archives, and directories
RedHatProductSecurity/component-registry: Component Registry (Corgi) aggregates component data across Red Hat's supported products, managed services, and internal product pipeline services.
OSS Insight, powered by TIDB Cloud, is an insight tool that can help you analyze in depth any single GitHub repository/developers, compare any two repositories using the same metrics, and provide comprehensive, valuable, and trending open source insights.
Announcing the Private Beta of FOSSA Risk Intelligence
From Projects | Software Transparency Foundation, see OSSKB | Free Open Source Inventorying
- And particularly: scanoss.py/PACKAGE.md at main · scanoss/scanoss.py
Artifact Hub, featuring Packages security report and also verifies with cosign

SCA and SBOM

This section includes: package/library scanners and detectors, SBOM formats, standards, authoring and validation, and a few applications. Will likely include SCA.

The most complete reference is awesomeSBOM/awesome-sbom

More interesting resources:

A few open source projects are documenting, in public, how they acquire dependencies. This intentional, human-parsable, long-form examples can be illustrative:

Vulnerability information exchange

A dedicated section on VEX reads:

CycloneDX - Vulnerability Exploitability Exchange (VEX)

Also see:

Vulncode-DB on deprecation path
GitHub brings supply chain security features to the Rust community
CyCognito Adopts Mapping ATT&CK to CVE for Impact
Read: A closer look at CVSS scores, Patch Madness: Vendor Bug Advisories Are Broken, So Broken and An Incomplete Look at Vulnerability Databases & Scoring Methodologies
Read: How to Analyze an SBOM and How to Generate and Host SBoMs from Cloudsmith
Read: After the Advisory from Google's Open Source Insights team

Point-of-use validations

This section includes: admission and ingestion policies, pull-time verification and end-user verifications.

Kyverno
- Read: Attesting Image Scans With Kyverno
ckotzbauer/sbom-operator: Catalogue all images of a Kubernetes cluster to multiple targets with Syft
CONNAISSEUR - Verify Container Image Signatures in Kubernetes
Open Policy Agent
Conftest allows to write tests against structured configuration data using the Open Policy Agent Rego query language: here's an example
Several pre-commit hooks allow vulnerability checking right before dependency ingestion time into the codebase
- e.g., pyupio/safety: Safety checks your installed dependencies for known security vulnerabilities
  - Or npm-audit
    - Also see snyk-labs/snync: Mitigate security concerns of Dependency Confusion supply chain security risks
    - And lirantal/lockfile-lint: Lint an npm or yarn lockfile to analyze and detect security issues
  - Or requires.io | Monitor your dependencies
  - Or Brakeman Security Scanner
  - Or trailofbits/pip-audit: Audits Python environments and dependency trees for known vulnerabilities
    - Also see: Dependabot alerts now surface if your code is calling a vulnerability
  - Interesting Python-related project: Project Thoth, using Artificial Intelligence to analyse and recommend software stacks for Python applications
  - Or Checkmarx/chainjacking: Find which of your go lang direct GitHub dependencies is susceptible to ChainJacking attack
  - Or Cargo Vet
  - Not automated validation, but comprehensive guidance for Java with a few critical points relating to supply chain security: Google Best Practices for Java Libraries
Static analysis is often used at this stage in order to detect dependency acquisition, e.g.:
Vulnerability Assessment | OpenSCAP portal
Detecting Log4Shell with Wazuh
aquasecurity/starboard: Kubernetes-native security toolkit
- Get started with Kubernetes Security and Starboard
armosec/kubescape: Kubescape is a K8s open-source tool providing a multi-cloud K8s single pane of glass, including risk analysis, security compliance, RBAC visualizer and image vulnerabilities scanning.
- Also: kubescape Visual Studio Code extension
ckotzbauer/vulnerability-operator: Scans SBOMs for vulnerabilities
chen-keinan/kube-beacon: Open Source runtime scanner for k8s cluster and perform security audit checks based on CIS Kubernetes Benchmark specification
aquasecurity/kube-bench: Checks whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark and aquasecurity/kube-hunter: Hunt for security weaknesses in Kubernetes clusters
openclarity/kubeclarity: KubeClarity is a tool for detection and management of Software Bill Of Materials (SBOM) and vulnerabilities of container images and filesystems
stackrox/stackrox: The StackRox Kubernetes Security Platform performs a risk analysis of the container environment, delivers visibility and runtime alerts, and provides recommendations to proactively improve security by hardening the environment.
cloudquery/plugins/source/k8s/policies at main · cloudquery/cloudquery
quarkslab/kdigger: Kubernetes focused container assessment and context discovery tool for penetration testing
ossillate-inc/packj: The vetting tool 🚀 behind our large-scale security analysis platform to detect malicious/risky open-source packages and Packj | A vetting tool to avoid "risky" packages

Also see:

Supply chain beyond libraries

And a few things to watch beyond libraries and software dependencies:

Identity, signing and provenance

This section includes: projects and discussions specifics to developer identity, OIDC, keyrings and related topics.

Frameworks and best practice references

This section includes: reference architectures and authoritative compilations of supply chain attacks and the emerging categories.

in-toto | A framework to secure the integrity of software supply chains
Supply chain Levels for Software Artifacts or SLSA (salsa) is a security framework, a check-list of standards and controls to prevent tampering, improve integrity, and secure packages and infrastructure in your projects, businesses or enterprises.
- Great read: SLSA | CloudSecDocs
- Another L50 read: Building trust in our software supply chains with SLSA
- Read: SLSA for Success: Using SLSA to help achieve NIST’s SSDF and All about that Base(line): How Cybersecurity Frameworks are Evolving with Foundational Guidance
  - Also, a framework mapping put together by Red Hat
- A Practical Guide to the SLSA Framework by FOSSA
- Read: Securing Gitpod's Software Supply Chain with SLSA
- Read: A First Step to Attaining SLSA Level 3 on GitHub
- And a pattern search across GitHub for inspiration (thanks @infernosec)
OWASP Application Security Verification Standard, esp. V14 - Configuration
OWASP/Software-Component-Verification-Standard: Software Component Verification Standard (SCVS)
CREST launches OWASP Verification Standard (OVS)
SAFECODE's Fundamental Practices for Secure Software Development, Third Edition, esp. Manage Security Risk Inherent in the Use of Third-party Components
SSF | The Secure Software Factory and mlieberman85/supply-chain-examples
- Related: A MAP for Kubernetes supply chain security
Software Supply Chain Risk Management | BSIMM
microsoft/scim: Supply Chain Integrity Model
- Also see: Supply Chain Integrity, Transparency, and Trust (scitt)
Goodbye SDLC, Hello SSDF! What is the Secure Software Development Framework?
- Also Comply with NIST's secure software supply chain framework with GitLab
The Supply Chain Risk Management section of SP 800-53 Rev. 5, Security and Privacy Controls for Info Systems and Organizations | CSRC, also see center-for-threat-informed-defense/attack-control-framework-mappings: Security control framework mappings to MITRE ATT&CK
SP 800-161 Rev. 1, C-SCRM Practices for Systems and Organizations | CSRC
npm Best Practices Guide (OpenSSF) - Features and recommendations on using npm safely
CIS Software Supply Chain Security Guide
microsoft/oss-ssc-framework: Open Source Software Secure Supply Chain Framework
GitHub's Implementing software security in open source
Previously referenced: Google Best Practices for Java Libraries
MITRE's System of Trust
Securing the Software Supply Chain for Developers was published by the National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and the Office of the Director of National Intelligence (ODNI) under the Enduring Security Framework (ESF) initiative

Also see:

Zero Trust the Hard Way, Kelsey Hightower
KubePhilly March 2022- A Look At The Kubernetes SLSA Compliance Project
Supply Chain Risk Management

Build techniques

This section includes: reproducible builds, hermetic builds, bootstrappable builds, special considerations for CI/CD systems, best practices building artifacts such as OCI containers, etc.

Reproducible Builds, particularly the Documentation
- r-b ecosytem mapping
- Reproducible Builds / reprotest
- Is NixOS Reproducible?
Bootstrappable Builds (GNU Mes Reference Manual)
- Also read Bootstrappable builds from LWN
kpcyrd/pacman-bintrans: Experimental binary transparency for pacman with sigstore and rekor
tektoncd/chains: Supply Chain Security in Tekton Pipelines
- Verifiable Supply Chain Metadata for Tekton - CD Foundation
google/santa: A binary authorization system for macOS
fepitre/package-rebuilder: Standalone orchestrator for rebuilding Debian, Fedora and Qubes OS packages in order to generate in-toto metadata which can be used with apt-transport-in-toto or dnf-plugin-in-toto to validate reproducible status.
kpcyrd/rebuilderd-debian-buildinfo-crawler: Reproducible Builds: Scraper/Parser for https://buildinfos.debian.net into structured data
- Also see Reproducible Builds: Debian and the case of the missing version string - vulns.xyz
kpcyrd/rebuilderd: Independent verification of binary packages - reproducible builds
tag-security/sscsp.md at main · cncf/tag-security
defenseunicorns/zarf: DevSecOps for Air Gap & Limited-Connection Systems. https://zarf.dev/
Lockheed Martin / hoppr / hoppr is a CLI framework for defining, validating, and transferring dependencies between environments
On instrumenting runners:
- Keep an eye on Draft: POC Witness Runner integration (!1) · Merge requests · testifysec / gitlab-runner for GitLab runners
reposaur/reposaur: Open source compliance tool for development platforms.
buildsec/frsca is an implementation of the CNCF's Secure Software Factory Reference Architecture. It is also intended to follow SLSA requirements closely and generate in-toto attesttations for SLSA provenance predicates.
aquasecurity/chain-bench: an open-source tool for auditing your software supply chain stack for security compliance implementing checks for CIS 1.0 | Vulnerability Database | Aqua Security
ossf/allstar: GitHub App to set and enforce security policies
scribe-public/gitgat: Evaluate source control (GitHub) security posture
oss-reproducible - Measures the reproducibility of a package based on its purported source. Part of OSS Gadget
jart/landlock-make: Sandboxing for GNU Make has never been easier
- Read: Using Landlock to Sandbox GNU Make
veraison/veraison: Project Veraison will build software components that can be used to build Attestation Verification Services
Changelog for Pants 2: The ergonomic build system
Bazel is an open source build and test tool similar to Make, Maven, and Gradle
GoogleContainerTools/kaniko: Build Container Images In Kubernetes

Also see:

Talks, articles, media coverage and other reading

Getting started and staying fresh

A few resources, in addition to this repository, that can help keep up with news and announcements:
- An RSS feed maintained by @bureado with a mix of open source security, DevSecOps, AppSec and supply chain security news: corner-security
- tl;dr sec Newsletter
- Past Issues | CloudSecList
- News - reproducible-builds.org
- A great compilation of reads, context and learning materials: chainguard-dev/ssc-reading-list: A reading list for software supply-chain security.
- A visual reference by Enso Security: AppSec Map
- wg-security-tooling/guide.md at main · ossf/wg-security-tooling from ossf/wg-security-tooling: OpenSSF Security Tooling Working Group
- A toolbox for a secure software supply chain from Chainguard
- The Technology chapter in Snyk's DevSecOps series
- A helpful list of acronyms: Acronyms | OpenSCAP portal
- slsa/terminology.md at main · slsa-framework/slsa
- Watch: How to start learning about Supply Chain Security
- Watch: Open Source Supply Chain Security: A Visualization of the Checkmarx Solution, plus the Checkmarx channel on YouTube has excellent explanatory videos for tactics, techniques and procedures in the supply chain security domain, for example: Large Scale Campaign Created Fake GitHub Projects Clones with Fake Commit Added Malware

And a collection of reads and listens, ranging from insightful blog posts, explainers/all-rounders and some long-form analysis (we've tried to keep deep dive reads scoped to other sections)

Secure Software Development Fundamentals Courses - Open Source Security Foundation
- Securing Your Software Supply Chain with Sigstore
Census II of Free and Open Source Software — Application Libraries
“Chain”ging the Game - how runtime makes your supply chain even more secure
How to attack cloud infrastructure via a malicious pull request
The Challenges of Securing the Open Source Supply Chain
What is a Software Supply Chain Attestation - and why do I need it?
Open Policy Agent 2021, Year in Review
Reproducibility · Cloud Native Buildpacks and Buildpacks and SBOM Integration Opportunities
The state of software bill of materials: SBOM growth could bolster software supply chains
Secure Your Software Supply Chain with New VMware Tanzu Application Platform Capabilities
- Secure Software Supply Chains
A few resources to understand supply chain compromises:
- Supply Chain Compromise - attackics
- tag-security/supply-chain-security/compromises at main · cncf/tag-security
- IQTLabs/software-supply-chain-compromises: A dataset of software supply chain compromises. Please help us maintain it!
- And a classic, Backstabber's Knife Collection: A Review of Open Source Software Supply Chain Attacks
- Also follow: Publish list of OSS compromises and how SLSA can help · Issue #222 · slsa-framework/slsa and watch ossf/oss-compromises
- Python-specific example: Bad actors vs our community: detecting software supply chain... by Ajinkya Rajput and Ashish Bijlani
- A comprehensive all rounder: Protect Yourself Against Supply Chain Attacks - Rob Bos - NDC Security 2022
Improving TOFU (trust on first use) With Transparency
Reports:
- 2022 State of Cloud Native Security Report - Palo Alto Networks
- 2022 Software Supply Chain Security Report • Anchore
End-to-end demos and examples:
- goreleaser/supply-chain-example: Example goreleaser + github actions config with keyless signing and SBOM generation
- Improve supply chain security with GitHub actions, Cosign, Kyverno and other open source tools
Using SARIF to Extend Analysis of SAST Tools
GitLab's Software Supply Chain Security section
- Also read GitLab's Software Supply Chain Security Direction
GitHub's SARIF support for code scanning
Driving Developer Productivity via Automated Dependency Tracking
Code scanning finds more vulnerabilities using machine learning
Securing Open Source Software at the Source
Security: The Value of SBOMs
Why SBOMS & Security Scanning Go Together - Upstream: The Software Supply Chain Security Podcast presented by Anchore
Whose Sign Is It Anyway? - Marina Moore, NYU & Matthew Riley, Google
Binary Authorization for Borg: how Google verifies code provenance and implements code identity
Application Security Weekly (Video) on Apple Podcasts
How to prioritize the improvement of open source software security
- And Strengthening digital infrastructure: A policy agenda for free and open source software
Software Supply Chain Security Turns to Risk Mitigation
Reproducible Builds: Increasing the Integrity of Software Supply Chains
sigstore/community: General sigstore community repo
CycloneDX Use Cases
- Listen: #6: Steve Springett: CycloneDX and the Future of SBOMs - Cybellum
Building a Sustainable Software Supply Chain, particularly the section: "The Software Supply Chain Sustainability Maturity Model"
Dependency Issues: Solving the World’s Open Source Software Security Problem offers a well meditated view on the problem space as well
The Digital Economy Runs on Open Source. Here’s How to Protect It (HBR)
Report: 95% of IT leaders say Log4shell was ‘major wake-up call’ for cloud security
Presentation: Securing the Open Source Software Supply Chain at PyConUS2022 by Dustin Ingram
Watch: The state of open source security in 2022 with Kurt Seifried
Podcast: Kubernetes Podcast from Google: Episode 174 - in-toto, with Santiago Torres-Arias
EO 14028 and Supply Chain Security
Reducing Open Source Risk Throughout the Development, Delivery and Deployment of SBOMs, a May 2022 paper illustrating at a high level the differences between SBOMs in publishing, distribution and delivery scenarios; see pages 6-9
Open Source Security Foundation (OpenSSF) Security Mobilization Plan
Not Just Third Party Risk
Open Source Security: How Digital Infrastructure Is Built on a House of Cards
Series: Bootstrapping Trust Part 1 covering encryption, certificates, chains and roots of trust
Contact sign-up sheet required: The Rise of Continuous Packaging by Cloudsmith and O'Reilly

abdulsattar-arctic / awesome-software-supply-chain-security Goto Github PK