José Miguel Parrella

ZeroProof. ZeroProof — local-only network security validation for UniFi

kettle. Kettle builds and verifies attested builds, packages that include cryptographically signed SLSA provenance.

Simard. Autonomous agent acting as an engineering director across a portfolio of repositories; also a platform for building distributed autonomous agents

structured-analysis-skill. Rigorous Structured Analysis to equip Agents to Think like Intelligence Analysts

try-cli. try - fresh directories for every vibe. Your experiments deserve a home. 🏠

awesome-agent-runtime-security. Learning something new about runtime security for agents

auto-minutes. Automatic minutes generation for IETF meetings

litebox. A security-focused library OS supporting kernel- and user-mode execution

mcp-server-security-standard. MCP Server Security Standard (MSSS): an open, testable security control standard for certifying MCP servers, with levels, evidence requirements, and reporting schemas.

nono. Sandbox any AI agent in seconds - zero setup, zero latency.

evaluation-criteria-matrix.

saf-mcp. SAF-MCP is a comprehensive security framework for documenting and mitigating threats in the AI Agent ecosystem.

datasketch. MinHash, LSH, LSH Forest, Weighted MinHash, HyperLogLog, HyperLogLog++, LSH Ensemble and HNSW

tvpo. Target, Value, Patterns and Objectives (TVPO) - A flexible threat modelling framework for the software supply chain

atlas-cli. A command-line interface tool for creating, managing, and verifying Content Provenance and Authenticity (C2PA) manifests for machine learning models, datasets, and related artifacts.

confidential-computing-cvm-guest-attestation. Confidential VM Platform Guest attestation sample apps

mcp. Catalog of official Microsoft MCP (Model Context Protocol) server implementations for AI-powered data access and tool integration

dusseldorf. Dusseldorf is an out-of-band security tool to help in security research.

ccfdns. A CCF-based, attested DNS server

attested-ohttp-server. This is a rust implementation of an attested OHTTP gateway

trivy-vulnerability-explorer. Web application that allows to load a Trivy report in json format and displays the vulnerabilities of a single target in an interactive data table.

Dependency-Timeline-Audit. Dependency Timeline Audit

distro-security-meetup. Ressources for the regular meeting of distribution security teams

keylime. A CNCF Project to Bootstrap & Maintain Trust on the Edge / Cloud and IoT

hashlookup-json-importer. Generic NDJSON importer for hashlookup server

hashlookup-server. Fast lookup server for NSRL and other hash database used in digital forensic

hashlookup-forensic-analyser. Analyse a forensic target (such as a directory) to find and report files found and not found from CIRCL hashlookup public service - https://circl.lu/services/hashlookup/

image-attestation. Go

in-toto. in-toto is a framework to protect supply chain integrity.

grype. A vulnerability scanner for container images and filesystems

criticality_score. Gives criticality score for an open source project

tag-security. 🔐CNCF Security Technical Advisory Group -- secure access, policy control, privacy, auditing, explainability and more!

model-transparency. Supply chain security for ML

tac. Technical Advisory Council

rust-keylime. Rust implementation of the keylime agent

rekor. Software Supply Chain Transparency Log

go-tpm-tools. Go packages built on go-tpm providing a high-level API for using TPMs

enclave-cc. Process-based Confidential Container Runtime

draft-ietf-rats-corim. A repository to define IETF RATS Concise Reference Integrity Manifest (CoRIM) Data Format Standard for supplying Reference Values and Endorsed Values

hipcheck. Automatically assess and score software repositories for supply chain risk.

octoscan. Octoscan is a static vulnerability scanner for GitHub action workflows.

bomctl. Format agnostic SBOM tooling

formal-spec-TEE. Formal specification of attestation mechanisms in Confidential Computing

meetings. Meeting materials

snpguest. A CLI tool for interacting with SEV-SNP guest environment

sev-guest. Tools, scripts, and configuration files necessary to demonstrate an end-to-end remote attestation example with SEV-SNP.

go-sev-guest. go-sev-guest offers a library to wrap the /dev/sev-guest device in Linux, as well as a library for attestation verification of fundamental components of an attestation report.

trustee. Attestation and Secret Delivery Components

C2SP. Community Cryptography Specification Project

ast-grep-essentials. Community-led collection of essential ast-grep rules.

goatrodeo. Deep Inspection - Artifact Dependency Graph

omnibor-rs. Rust implementation of OmniBOR, reproducible identifiers & fine-grained build dependency tracking for software artifacts.

specification.

azure-privacy-sandbox-kms. TypeScript

CCF. Confidential Consortium Framework

scitt-ccf-ledger. Supply Chain Integrity Transparency and Trust ledger application using Confidential Consortium Framework (CCF)

osim. OASIS OSIM TC: Working directory for OSIM TC

transparency-exchange-api. A standard API specification for exchanging supply chain artifacts and intelligence

ai-ml-security. Working Group on Artificial Intelligence and Machine Learning (AI/ML) Security

what-the-src. Source code of https://whatsrc.org/

chainloop. SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

protobom. A universal SBOM representation in protocol buffers

sealed-secrets. A Kubernetes controller and tool for one-way encrypted Secrets

kubesec. Security risk analysis for Kubernetes resources

beyla. eBPF-based autoinstrumentation of web applications and network metrics

package-analysis. Open Source Package Analysis

wg-best-practices-os-developers. The Best Practices for OSS Developers working group is dedicated to raising awareness and education of secure code best practices for open source developers.

blueprint-securesoftwarepipeline. For engineers and security teams driving fast and secure software supply chains

overlay. Overlay is a browser extension helping developers evaluate open source packages before picking them

copacetic. 🧵 CLI tool for directly patching container images!

openssl-nov-1-critical-cve-2022-tracking.

hpsm. Go

annotate-registry-artifacts. CLI for adding OCI annotations to existing registry artifacts

image-layer-provenance. Container image provenance spec that allows tracing CVEs detected in registry images back to a CVE's source of origin.

SecureSoftwareSupplyChain. This repo is a consolidation of Secure Software Supply Chain resources, such as talks, whitepapers, conferences and more.

unlocker. ⚠️ Replaced by ItalyPaleAle/Revaulter! -- Wrap and unwrap keys using a key vault with admin consent

oss-ssc-framework. Open Source Software Secure Supply Chain Framework

OSSGadget. Collection of tools for analyzing open source packages.

dotnet. Ubuntu ROCKs for the .NET runtime and family

chisel. Go

omega-stracedb. A repository of strace results for lots of packages.

template-analyzer. Template scanner for security misconfiguration and best practices

security-devops-action. Microsoft Security DevOps for GitHub Actions.

Microsoft-Defender-for-Cloud. Welcome to the Microsoft Defender for Cloud community repository

sbom-tool. The SBOM tool is a highly scalable and enterprise ready tool to create SPDX 2.2 compatible SBOMs for any variety of artifacts.

DevSkim. DevSkim is a set of IDE plugins, language analyzers, and rules that provide security "linting" capabilities.

draft-birkholz-scitt-architecture. A specification including, problem statement, use cases, requirements, and architectural constituents for a Transparency Service in support of Supply Chain Integrity, Transparency, and Trust

zas. Most simple static website generator in Golang.

linux-package-repositories. Microsoft Packaged Linux Software (DEBs, RPMs, etc) are hosted on packages.microsoft.com (PMC) made available as native Linux repositories for use with package managers like APT, YUM, etc.

awesome-software-supply-chain-security. A compilation of resources in the software supply chain security domain, with emphasis on open source

gardenlinux. Garden Linux - The best Linux for Gardener nodes!

slsa. Supply-chain Levels for Software Artifacts

ossf-landscape.

witness. Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.

debrebuild. Given a buildinfo file from a Debian package, generate instructions for attempting to reproduce the binary packages built from the associated source and build information.

supply-chain-synthesis. Collating an overview of the open source software supply chain landscape -- and synthesizing that survey in a hopefully-useful way.

wg-securing-critical-projects. Helping allocate resources to secure the critical open source projects we all depend on.

component-detection. Scans your project to determine what components you use

azure-osconfig. A modular services stack that facilitates remote Linux devices management over Azure

ratify. Artifact Ratification Framework (CNCF Sandbox)

security-reviews. A community collection of security reviews of open source software components.

wsl2-systemd. Enable basic systemd service management support for WSL2

LinuxPatchExtension. Microsoft Azure VM Guest Linux Patch Extension

apt-transport-cloudflared.

apt-transport-oci. OCI transport plugin for apt-get (i.e., apt-get over ghcr.io)

package-metadata. A place to collect information about packages across various ecosystems

syft. CLI tool and library for generating a Software Bill of Materials from container images and filesystems

spdx-oin. SPDX documents and related code for OIN's Linux System Definition packages

spdx-sbom-generator. Support CI generation of SBOMs via golang tooling.

scim. Supply Chain Integrity Model

cyclonedx-linux-generator. Lockheed Martin developed utility to generate CycloneDX SBOMs for Linux distributions

kubernetes-workshop. ⚙️ A Gentle introduction to Kubernetes with more than just the basics. 🌟 Give it a star if you like it.

akri. A Kubernetes Resource Interface for the Edge

waypoint. A tool to build, deploy, and release any application on any platform.

whatfiles. Log what files are accessed by any Linux process

percollate. A command-line tool to turn web pages into readable PDF, EPUB, HTML, or Markdown docs.

wg-security-tooling. OpenSSF Security Tooling Working Group

wg-supply-chain-integrity. Our objective is to enable open source maintainers, contributors and end-users to understand and make decisions on the provenance of the code they maintain, produce and use.

opensource.microsoft.com. This is the source code to the mostly-static Microsoft Open Source site featuring projects, program information, and "get involved" pages.

azurelinux. General purpose Linux OS for Azure

CloudShell. Container Image for Azure Cloud Shell (https://azure.microsoft.com/en-us/features/cloud-shell/)

decentralized-identity.github.io. Site for the open source, community-driven group of dev and organizations working toward an interoperable, decentralized identity ecosystem

azvmimagebuilder. Azure VM Image Builder

choose. A human-friendly and fast alternative to cut (and sometimes awk)

oneinfra. Kubernetes as a Service

InnerSourcePatterns. These patterns document how to apply open source principles and practices for software development within the confines of an organization - aka InnerSource.

sidetree. Sidetree Specification and Reference Implementation

linux-observability-with-bpf. Code snippets from the O'Reilly book

sgx-lkl. SGX-LKL Library OS for running Linux applications inside of Intel SGX enclaves

Azure-Readiness-Checklist. This checklist is your guide to the best practices for deploying secure, scalable, and highly available infrastructure in Azure. Before you go live, go through each item, and make sure you haven't missed anything important!

distri. a Linux distribution to research fast package management

deb-ostree-builder. Stripped down Endless ostree builder for debian

dnote. A simple command line notebook

websocketd. Turn any program that uses STDIN/STDOUT into a WebSocket server. Like inetd, but for WebSockets.

rest-fs. REST API FUSE filesystem experiment

debos. Debian OS builder

build-your-own-radar. A library that generates an interactive radar, inspired by https://thoughtworks.com/radar/.

mdCanvas. Create a Lean Canvas out of a markdown list

blog. Aquí está el código original de los artículos publicados en programar.cloud

sidedoor. SSH connection daemon for Debian/Raspbian/Ubuntu/etc

dcos-kafka-cassandra. Python

sysunconfig.

awesome-sysadmin. A curated list of amazingly awesome open source sysadmin resources inspired by Awesome PHP.

fpi. no longer needed because snaps are a thing

azure-service-broker-client. Java

ansible-azure-lab. Lab to play with Azure using Ansible playbooks

MicrosoftDevOps.github.io. Repository of the Microsoft DevOps Evidences

docker-and-containers-ebooks. A series of ebooks on Docker and the container ecosystem.

AzureRunMe. Runs third party technologies on Windows Azure

autorest. OpenAPI (f.k.a Swagger) Specification code generator. Supports C#, PowerShell, Go, Java, Node.js, TypeScript, Python

connectthedots. Connect tiny devices to Microsoft Azure services to build IoT solutions

azure-linux. Documentation and examples for how to leverage various linux technologies with Azure

azpipe. A set of shims and tools for piping things to Azure

aguilas. [ARCHIVED] A web-based LDAP user management system written in PHP.