This repository is the official npm command-line interface (CLI), the package manager for JavaScript and Node.js. It provides a comprehensive set of subcommands for installing, publishing, managing dependencies, auditing security, generating SBOMs, and configuring registry access. The architecture follows a modular monorepo pattern with workspaces for core functionality: arborist (dependency tree resolution and reification), config (layered configuration), libnpmexec (npx execution), libnpmpublish (publishing with provenance), libnpmdiff (package diffing), and others. The CLI is built on a command class hierarchy (BaseCommand) with consistent parameter handling, workspace support, and shell completion. Key data flows involve fetching packuments from registries, resolving dependency graphs, manipulating node_modules trees, and writing lockfiles. External dependencies include registry APIs, Sigstore for signing, TUF for key management, and various npm ecosystem libraries. The codebase is actively maintained with extensive test coverage using tap, mock-registry, and snapshot testing.
vexctl is a command-line tool for creating, applying, and attesting VEX (Vulnerability Exploitability eXchange) data. It is built as a single binary using Cobra for CLI, with subcommands for creating VEX documents, merging them, filtering SARIF scanner results, generating attestations, and validating documents against the OpenVEX specification. The tool integrates with Sigstore for keyless signing and supports multiple VEX formats (OpenVEX native, CSAF, CycloneDX). It can attach VEX attestations to container images via OCI referrers API or legacy tag layout. The architecture follows a clean separation of concerns: CLI handlers in `internal/cmd/` delegate to a core library in `pkg/ctl/`, which uses an interface (`Implementation`) for testability. The `pkg/attestation/` package handles in-toto attestations and Sigstore signing independently. The codebase demonstrates strong engineering practices with dependency injection, options struct patterns, and comprehensive test data. While primarily an application, it also processes vulnerability data (SARIF, VEX documents) and includes validation logic that could be reused in other security tooling.
This repository hosts the SLSA (Supply-chain Levels for Software Artifacts) specification, a security framework for software supply chain integrity. It is primarily a documentation and specification project, not a software application or a data pipeline. The repository contains the normative specification documents (e.g., build provenance, source requirements, dependency track), a Jekyll-based website for versioned publication, tooling scripts for linting and version management, and CI/CD workflows for maintaining the site. It defines formal attestation schemas in Protobuf and CUE, provides threat models and security principles, and includes community blog posts and how-to guides. While not a standalone deployable application, it serves as the authoritative reference for SLSA levels, tracks, and verification protocols, and its reusable patterns (provenance predicate formats, site navigation components, assessment prompts) can be adopted by other security specification projects.
FOSSLight Hub is an open-source compliance and security platform that manages open source software (OSS) inventories, licenses, vulnerabilities, and compliance workflows. It provides a web interface for OSS identification, license management, vulnerability tracking, self-check audits, SBOM generation (SPDX, CycloneDX), and supply chain management. The system is architected as a Spring Boot backend with MyBatis persistence, JWT-based authentication, and REST APIs (v2 and lite). It features a dual frontend: a legacy server-rendered UI using jqGrid and Thymeleaf, and a modern Next.js 'lite' client built with React, Tailwind CSS, and Recoil. Key entry points include API controllers (e.g., LiteOssController, ApiOssV2Controller), service layer components, and scheduled tasks for NVD/OSV vulnerability synchronization. External dependencies include MariaDB, a mail server, external license APIs (GitHub, ClearlyDefined), NVD/OSV vulnerability feeds, and the FOSSLight Scanner. The platform is actively developed with continuous releases and a growing feature set, though it carries some technical debt from legacy frontend libraries and enterprise-specific hardcoding.