TechPrufer
Sign inGet started

Blogs›Temporal›Software Supply Chain Security Tooling

Software Supply Chain Security Tooling

Software Supply Chain Security Tooling

1
posts
2026

Deputy is an open-source, CLI-first security toolchain for inventorying, scanning, triaging, and controlling dependencies across repositories, container images, VM disk images, SBOMs, and other targets. It provides a customizable policy layer using CEL for local development, CI, and download time enforcement. Key features include vulnerability analysis with exploitability enrichment (KEV, EPSS), SLA enforcement for advisories, and protection against lookalike packages. Deputy also offers sandboxed execution (`deputy exec`) and download-time policy enforcement (`deputy proxy`).

2026

Introducing Deputy: Better signal and control for software supply chains

8/3/2026

This post introduces Deputy, a new open-source toolchain for software supply chain security. It details the challenges of vulnerability management, including false positives and the need for context-aware analysis. Deputy's architecture is described, highlighting its plugin system, package extractors (leveraging OSV-SCALIBR), and data enrichment capabilities. The post elaborates on the policy system using CEL, providing examples for exploit signal gating, vulnerability SLA enforcement, and lookalike package warnings. It also covers Deputy's remediation features (`deputy triage`, `deputy fix`), sandboxed execution (`deputy exec`), and download-time proxy (`deputy proxy`).