C

cyclonedx

Turns a CycloneDX or SPDX SBOM into an EU Cyber Resilience Act dossier with a SIGILLATO / APERTO stamp. Rust engine, command line, offline browser page, Typst print.

Analyzer that scans for application dependencies.

Dresses a Debian package for release under the EU Cyber Resilience Act: SBOM of what it really loads, Sigillo dossier, signed manifest, release page. One static binary.

Analyze SBOM dependency graph complexity to predict BuildDependencyGraphWorker performance.

Fail-closed VEX disposition engine for Iron Bank container findings. Joins findings against public sources (Red Hat CSAF, GitLab CNA, OSV) and emits cited triage worksheets, OpenVEX, and CycloneDX 1.7 VDR.

Open Source security and compliance gate for GitLab CI and GitHub Actions: SBOM, dependency vulnerabilities, SAST, secrets, IaC and licenses, under one versioned policy and one verdict. No SaaS, no code sent to a third party.

An SBOM of what you actually ship: one CycloneDX SBOM per artefact of a release package, a product SBOM, a completeness record and a vulnerability gate.

Turns a CycloneDX or SPDX SBOM into a Cyber Resilience Act readiness report. https://cradesk.eu

Convert CycloneDX JSON or XML docs to PDF reports. Was designed to work for VEX reports but can also generate PDFs for standard BoMs.

BETA: Dependency Scanning for supported projects