16 个专用工具16 focused tools
软件清单与来源Software inventory & provenance
解析软件包、镜像清单、来源声明与漏洞描述。把已声明的信息展开，保留验证状态和知识边界。Parse packages, image manifests, provenance statements, and vulnerability descriptions. Expand declared information while keeping verification status and limits explicit.
查看工具Explore tools ↓你可以从这些问题开始。A few useful starting points.
- 依赖交接：用 PackageLockAudit、POMAudit 或 WheelRecordAudit 阅读包记录。For dependency handoff: read package records with PackageLockAudit, POMAudit, or WheelRecordAudit.
- 来源材料：用 SLSAProvenanceAudit、DSSEAudit 或 SigstoreBundleAudit 查看声明结构；解析不代表验签。For provenance material: inspect statement structures with SLSAProvenanceAudit, DSSEAudit, or SigstoreBundleAudit; parsing is not signature verification.
- 漏洞描述：用 OSVAudit、CSAFAudit 或 CVSS31Audit 阅读结构、范围和评分输入。For vulnerability descriptions: review structures, ranges, and score inputs with OSVAudit, CSAFAudit, or CVSS31Audit.
选择你的工作台Choose your workbench
锁树审PackageLockAudit
检查包位置、版本、根直接依赖、resolved 主机、SRI 语法和链接项。Inspect package locations, versions, root direct dependencies, resolved hosts, SRI syntax, and link entries.
审计 package-lockAudit package-lock ↗轮档审WheelRecordAudit
解析 RECORD 三列 CSV，检查重复/穿越路径、哈希语法、大小和自身空记录。Parse three-column RECORD CSV and check duplicate/traversing paths, hash syntax, sizes, and its empty self-row.
审计 Wheel RECORDAudit Wheel RECORD ↗构模审POMAudit
核对项目坐标、直接依赖、scope、optional、当前 POM 属性和 build plugin。Reconcile project coordinates, direct dependencies, scope, optional flags, current-POM properties, and build plugins.
审计 Maven POMAudit Maven POM ↗镜像图OCIManifestAudit
审计 manifest/index 的 schema、媒体类型、描述符、摘要、大小、平台和注解。Audit manifest/index schema, media types, descriptors, digests, sizes, platforms, and annotations.
审计 OCI 元数据Audit OCI metadata ↗证明账AttestationAudit
检查 Statement v1 的 subject、DigestSet、predicateType 和 predicate 顶层结构。Inspect Statement v1 subjects, DigestSets, predicateType, and top-level predicate structure.
审计证明 StatementAudit attestation ↗溯源账SLSAProvenanceAudit
核对 SLSA Provenance v1 的 builder、参数、resolved dependencies 和运行时间顺序。Reconcile SLSA Provenance v1 builder, parameters, resolved dependencies, and run-time ordering.
审计 SLSA ProvenanceAudit SLSA provenance ↗信封审DSSEAudit
解码 DSSE base64 payload，识别 JSON Statement，并汇总 keyid 与签名字节。Decode a DSSE base64 payload, identify a JSON Statement, and summarize key IDs and signature bytes.
审计 DSSE EnvelopeAudit DSSE envelope ↗签束审SigstoreBundleAudit
检查 Bundle mediaType、签名内容、证书、透明日志条目和 base64 编码。Inspect Bundle mediaType, signed content, certificates, transparency-log entries, and base64 encodings.
审计 Sigstore BundleAudit Sigstore bundle ↗软件料SPDXAudit
预检 SPDX 2.3 文档、包、文件、校验和、许可证字段、SPDXID 和关系引用。Preflight SPDX 2.3 documents, packages, files, checksums, license fields, SPDXIDs, and relationship references.
审计 SPDXAudit SPDX ↗漏洞域OSVAudit
检查 OSV 1.8.0 的记录身份、时间、包、范围、版本事件和参考 URL。Inspect OSV 1.8.0 record identity, timestamps, packages, ranges, version events, and reference URLs.
审计 OSVAudit OSV ↗影响述OpenVEXAudit
核对 OpenVEX 0.2 文档、漏洞、产品 ID、状态和 not_affected 理由。Reconcile OpenVEX 0.2 documents, vulnerabilities, product IDs, statuses, and not_affected rationale.
审计 OpenVEXAudit OpenVEX ↗通告谱CSAFAudit
检查 CSAF 2.0 的跟踪信息、产品 ID、漏洞状态、评分引用和修复建议。Inspect CSAF 2.0 tracking, product IDs, vulnerability statuses, score references, and remediations.
审计 CSAFAudit CSAF ↗包址析PURLAudit
拆解 PURL 的 type、namespace、name、version、qualifiers、subpath 与编码约束。Break PURLs into type, namespace, name, version, qualifiers, subpath, and encoding constraints.
审计 PURLAudit PURLs ↗许可式SPDXExpressionAudit
递归解析 SPDX Annex D 的 LicenseRef、WITH、AND、OR、优先级与括号。Recursively parse SPDX Annex D LicenseRefs, WITH, AND, OR, precedence, and parentheses.
解析 SPDX 表达式Parse SPDX expressions ↗平台名CPEAudit
拆解 formatted string 与 URI binding 的 part、vendor、product 和 version。Break formatted strings and URI bindings into part, vendor, product, and version.
审计 CPEAudit CPE ↗基分尺CVSS31Audit
按 FIRST 公式检查八项 CVSS 3.1 Base 指标并计算 Impact、Exploitability 与分数。Check eight CVSS 3.1 Base metrics and calculate Impact, Exploitability, and score with FIRST equations.
计算 CVSS 3.1Calculate CVSS 3.1 ↗工具不访问实时漏洞数据库，不证明软件安全或许可证合规，也不把文件中的来源声明当作已验证事实。The tools do not query live vulnerability databases, prove software safety or license compliance, or treat provenance claims as verified facts.
工具找对了，先试一个样例。Found a tool? Try its sample.
结果配合页面说明一起看，重要用途请独立复核。Read results alongside the tool's explanation, and independently verify important decisions.