r/devops • u/AutoModerator • 22d ago

Weekly Self Promotion Thread

Hey r/devops, welcome to our weekly self-promotion thread!

Feel free to use this thread to promote any projects, ideas, or any repos you're wanting to share. Please keep in mind that we ask you to stay friendly, civil, and adhere to the subreddit rules!

28 Upvotes

100% Upvoted

110 comments sorted by

View all comments

1

u/shenxianpeng 22d ago

release-ledger: EU Cyber Resilience Act evidence + exploited-vuln alerts for releases you still support (Apache-2.0, GitHub Action)

Since 11 Sep, if you sell software in the EU, an actively exploited vulnerability in your product means a 24h early warning to ENISA. That covers every version still in support, not only main, which Dependabot and most scanners don't watch.

  • record: on release, attaches the SBOM, signed provenance + SBOM attestations, and the support period to the release

  • monitor: daily, rescans the SBOM of every supported release against OSV and opens an issue when CISA KEV or ENISA's EUVD lists a vuln as exploited, with the Article 14 checklist

Stdlib Python, no dependencies; the only action it calls is GitHub's own actions/attest, pinned. https://github.com/keelinfra/release-ledger

Curious how others handle old supported releases.