The System Package Data Exchange (SPDX) specification in Markdown and HTML formats.

specification spdx licenses bill-of-materials linux-foundation software-bill-of-materials software-package-data-exchange sbom spdx-sbom software-transparency

• Updated Nov 11, 2026
• Python

A compilation of Software Supply Chain Security resources including initiatives, standards, regulations, organizations, vendors, tooling, books, articles and a plethora of learning resources from the web.

cncf owasp vex vulnerability-management software-security dependency-management sbom attestations slsa open-source-security supply-chain-security supply-chain-attacks software-supply-chain-security openssf software-bill-of-material software-transparency

• Updated Jan 28, 2024

ReARM - Release Governance Platform

security supply-chain release vulnerability release-automation release-management software-supply-chain security-tools supply-chain-management release-engineering sbom cyclonedx supply-chain-visibility sbom-distribution software-supply-chain-security sbom-tool hardware-supplychain software-transparency cyclonedx-sbom

• Updated Nov 11, 2026
• Java

The model for the information captured in SPDX version 3 standard.

ontology spdx bill-of-materials linux-foundation software-bill-of-materials software-package-data-exchange sbom spdx-sbom software-transparency

• Updated Nov 11, 2026

Data and schema powering the worlds largest collection of SBOM/xBOM products, projects, and services

owasp vex vdr sbom cyclonedx obom mbom saasbom mlbom software-transparency aibom cbom hbom cdxa

• Updated Nov 5, 2026
• HTML

Automate vulnerability triage which prioritizes remediation over discovery

vex spdx vulnerability-management sca sarif sast oscal sbom cyclonedx slsa software-transparency

• Updated Nov 12, 2026
• Open Policy Agent

Secure Supply Chain Consumption Framework (S2C2F) OSCAL Catalog and tool

oscal s2c2f software-transparency

• Updated May 21, 2024
• Python

Ecma TC54 Website

ecma purl package-url sbom cyclonedx software-transparency tc54

• Updated Jul 31, 2026
• HTML

Common Lifecycle Enumeration

supply-chain owasp plm sbom cscrm software-lifecycle software-transparency

• Updated Oct 16, 2026

This repository will be renamed once an ECMA identifier is assigned to the standard.

supply-chain owasp vex vdr software-supply-chain sbom software-transparency sbom-sharing

• Updated Nov 11, 2026
• JavaScript

A trust-focused directory of open source Firefox extensions — ranked by public source, permission footprint, data collection and maintenance, not popularity.

open-source firefox firefox-addon addons-mozilla-org browser-extension cloudflare-workers supply-chain-security sveltekit software-transparency

• Updated Aug 25, 2026
• Svelte