Repositories list

• besu

  Public
  Perpetual automerge for Besu

  Java

  •

  Apache License 2.0

  •1k•0•1•97•Updated Feb 20, 2026Feb 20, 2026

• sbom-files

  Public
  Long term storage of software bills of materials (sbom) https://arxiv.org/pdf/2303.11102.pdf

  Python

  •2•7•1•2•Updated Feb 20, 2026Feb 20, 2026

• flink

  Public
  Perpetual automerge for Apache Flink

  Java

  •

  Apache License 2.0

  •14k•0•1•23•Updated Feb 20, 2026Feb 20, 2026

• aotp

  Public
  Looking inside AOTCache

  Java

  •0•0•4•0•Updated Feb 20, 2026Feb 20, 2026

• deps.dev_stats

  Public
  longitudinal study of package registry growth

  Python

  •0•1•0•0•Updated Feb 20, 2026Feb 20, 2026

• bump

  Public
  A dataset of reproducible breaking dependency updates, SANER 2024 (https://doi.org/10.1109/SANER60148.2024.00024)

  javadependency-analysis

  Java

  •

  MIT License

  •8•21•5•5•Updated Feb 20, 2026Feb 20, 2026

• ghasum

  Public
  Checksums for GitHub Actions.

  checksumslockfilegha

  Go

  •

  Apache License 2.0

  •1•18•20•1•Updated Feb 19, 2026Feb 19, 2026

• chains-project.github.io

  Public
  The source for the website of the SSF CHAINS project https://chains.proj.kth.se/

  HTML

  •

  MIT License

  •11•8•0•0•Updated Feb 18, 2026Feb 18, 2026

• zkSBOM

  Public
  zero knowledge SBOMs (thesis Tom Sorger)

  Rust

  •

  MIT License

  •0•3•0•0•Updated Feb 17, 2026Feb 17, 2026

• oZKS

  Public
  oZKS (Ordered Zero-Knowledge Set) is a library that provides an implementation of an Ordered (and Append Only) Zero-Knowledge Set.

  C++

  •

  MIT License

  •7•0•0•0•Updated Feb 17, 2026Feb 17, 2026

• maven-lockfile

  Public
  Lockfiles for Maven. Pin your dependencies. Build with integrity.

  Java

  •

  MIT License

  •14•55•15•6•Updated Feb 16, 2026Feb 16, 2026

• sbom.exe

  Public
  calls the police if a prohibited class is loaded by the JVM http://arxiv.org/pdf/2407.00246

  Java

  •

  MIT License

  •1•9•9•7•Updated Feb 15, 2026Feb 15, 2026

• dirty-waters

  Public
  automatically detect software supply chain smells and issues http://arxiv.org/pdf/2410.16049

  Python

  •

  MIT License

  •5•18•30•5•Updated Feb 13, 2026Feb 13, 2026

• dirty-waters-action

  Public
  Break the build if your supply chain is dirty

  MIT License

  •0•2•6•5•Updated Feb 12, 2026Feb 12, 2026

• pypi1000

  Public
  1000 Github repositories on Pypi

  Python

  •0•0•0•0•Updated Feb 9, 2026Feb 9, 2026

• javascript-bundling-reproducible-builds

  Public
  reproducible build study of javascript bundling (thesis E. Vitell)

  Python

  •0•0•0•0•Updated Feb 9, 2026Feb 9, 2026

• bombom

  Public
  grassroot bill of materials for linux

  Python

  •0•0•0•0•Updated Feb 8, 2026Feb 8, 2026

• dirty-waters-utils

  Public
  Scripts used to retrieve data and acquire results for dirty-waters

  Jupyter Notebook

  •0•0•0•0•Updated Feb 6, 2026Feb 6, 2026

• swag

  Public
  software supply chain art

  Java

  •1•2•1•11•Updated Feb 1, 2026Feb 1, 2026

• maven-hijack-poc

  Public
  Java-Class-Hijack: Software Supply Chain Attack for Java based on Maven Dependency Resolution and Java Classloading

  javasupply-chain-security

  Java

  •1•3•0•0•Updated Jan 30, 2026Jan 30, 2026

• spoon

  Public
  Perpetual automerge with CI for Spoon

  Java

  •

  Other

  •375•0•1•10•Updated Jan 23, 2026Jan 23, 2026

• classport-experiments

  Public
  Experiments related to the Classport projects

  Java

  •0•0•1•0•Updated Jan 21, 2026Jan 21, 2026

• classport

  Public
  Passports for Java class files

  Java

  •

  MIT License

  •1•2•14•0•Updated Jan 20, 2026Jan 20, 2026

• moduleinfo-generator

  Public
  Java

  •0•0•1•0•Updated Nov 25, 2025Nov 25, 2025

• reproducible-central

  Public
  Reproducible Central: rebuild instructions for artifacts published to (Maven) Central Repository

  Java

  •61•0•16•0•Updated Nov 15, 2025Nov 15, 2025

• goleash

  Public
  Runtime enforcement of software supply chain capabilities in Go

  C

  •0•19•1•0•Updated Nov 12, 2025Nov 12, 2025

• chains-rebuild

  Public
  Securing open-source package ecosystems by originating, validating, and augmenting build attestations.

  Go

  •

  Apache License 2.0

  •46•0•0•0•Updated Oct 24, 2025Oct 24, 2025

• lockfiles-comprehensive-study

  Public
  Java

  •0•2•0•0•Updated Oct 18, 2025Oct 18, 2025

• diffonomy

  Public
  diffoscope report analysis tool

  Python

  •

  MIT License

  •0•1•0•0•Updated Sep 22, 2025Sep 22, 2025

• btc-supply-chain

  Public
  Securing the Bitcoin software supply chain with an immutable database of SHA256

  bitcoinsupply-chain

  Python

  •1•1•1•2•Updated Sep 5, 2025Sep 5, 2025