slsa-framework

Hermeto is a CLI tool that prefetches project dependencies for hermetic container builds.

Example project using SLSA 3 Generic Generator with GoReleaser

Generates SBOMs remotely in a verifiable manner (SLSA Build L3)

Hardened, FIPS 140-3 compliant OpenSSL container on Wolfi OS. Features hermetic SLSA L3 builds, Zero-CVE distroless images, and a rigorous automated audit engine (50+ Tests & Benchmarks).

Create SLSA Provenance from nix flake

Jenkins Shared Library

AIBOM toolkit: CycloneDX 1.5 validator, JSON schema, hash utilities for AI BoM generation, validation, and supply-chain transparency.

🔒 Fail CI if dependencies in your lockfile lose npm provenance or trusted publisher status, enhancing the security of your projects.