I work on open-source tools for software supply chain security, mostly in Go.
My main project is zanadir. You point it at a repository and it looks at the CI pipeline, tells you what's missing (security scanning, linting, tests and so on) and suggests open-source tools that can fill the gap. If you'd rather run it in CI, there's a GitHub Action too.
I also contribute to Anchore's tools, usually when I hit something I need myself:
- syft: I added the
deep-squashedscope, which shows every layer a package lives in and not just the final one. Also a layer size limit and support for.karfiles. - grype: I wrote the first version of
grype db search, because I was tired of opening the database in a SQL client just to see if a CVE was in there. Later came suggested fix versions and end-of-life warnings based on the distro's ownSUPPORT_ENDdate. - vunnel: I wrote the end-of-life provider, which is where grype's EOL warnings get their data.
If something in zanadir is wrong or missing, open an issue.