Go
sigstore/sigstore
Common go library shared across sigstore services and clients
Apache-2.0Oct 21, 2026 · metrics 2.10.0
All tags
Catalogue tag
#cosign
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
11 records
Go · npm
zarf-dev/zarf
The Airgap Native Package Manager for Kubernetes
Apache-2.0Sep 12, 2026 · metrics 2.10.0
Go
ekristen/aws-nuke
Remove all the resources from an AWS account
MITSep 11, 2026 · metrics 2.10.0
crates.io
sigstore/sigstore-rust
Sigstore implemented in Rust for Github v0.3 bundles
Apache-2.0Sep 9, 2026 · metrics 2.10.0
Go
Nox-HQ/nox
Open-source security scanner with first-class AI app security (prompt injection, embedding leakage, agent over-privilege, MCP hardening). Polyglot AIBOM, SARIF, SBOM. Cosign-signed plugin marketplace. Offline-first, agent-native via MCP.
Apache-2.0Sep 13, 2026 · metrics 2.10.0
Go · npm
CodesWhat/portwing
Security-first remote Docker agent — authenticated Docker API proxy with outbound edge mode, Ed25519 per-request auth, and a cosign-signed, scratch-based supply chain. Drydock-native + generic REST.
AGPL-3.0Sep 9, 2026 · metrics 2.10.0
Go · PyPI
klarlabs-studio/mnemos
Self-hosted memory + evidence layer for AI agents (Claude Code, Codex, Hermes, ...) — embeddable Go library, MCP / HTTP / CLI, evidence-backed claims, bitemporal recall, axi-go execution kernel with JSONL audit + token budgets, cosign-signed releases with SLSA L3 provenance. No vendor cloud, no per-call billing.
MITSep 9, 2026 · metrics 2.10.0
Go
aimd54/palan
Distribute GGUF and safetensors weights through any OCI registry, with signatures verified before a byte moves. Daemonless, runs offline, one static binary.
Apache-2.0Sep 10, 2026 · metrics 2.10.0
Go
blairham/stevedore
Release Docker/OCI images the way GoReleaser releases binaries — build, scan, sign, SBOM, provenance, per-image versioning, and monorepo change detection.
MITSep 10, 2026 · metrics 2.10.0
Go · npm
daimoniac/suppline
Self-hosted Kubernetes image intake gateway: mirror → Trivy scan → CEL policy → Sigstore attestations. Admit only what passed.
Apache-2.0Sep 14, 2026 · metrics 2.10.0
npm
mwashburn160/pipeline-builder
Self-hosted platform for deploying and running software factories on AWS: secure delivery pipelines, a signed supply chain, policy-as-code compliance and multi-tenant governance — in minutes, not months.
Apache-2.0Oct 21, 2026 · metrics 2.10.0