gungnir-sanye / tee-attestation-extraction

Android TEE/KeyMint 技术研究：Keybox 与 RKP/DICE 原理、三台设备实践记录和验证方法 | Android TEE/KeyMint research notes on Keybox, RKP/DICE, and three device studies.

JingMatrix / TEESimulator

Software simulation for Android hardware-backed key pairs with key attestation

linuxboot / heads

A minimal Linux that runs as a coreboot or LinuxBoot(UEFI's DXE replacement) ROM payload to provide a secure, flexible boot environment for laptops, workstations and servers.

guacsec / guac

GUAC aggregates software security metadata into a high fidelity graph database.

sipyourdrink-ltd / bernstein

The open-source governance layer for AI agents: write the rules declaratively, Bernstein enforces them and produces the verifiable, replayable record. Free, Apache-2.0. https://bernstein.run

eltavine / Duck-Detector-Refactoring

Android environment integrity inspection tool for root, hook, bootloader, SELinux, virtualization, and attestation signals

VibeTensor / attestix

AI agent identity, signed credentials, delegated authority and portable governance evidence. Python core and offline verifier SDKs.

GrapheneOS / grapheneos.org

Servers for our website, HTTP/HTTPS connectivity checks, HTTPS network time, NTP (for Qualcomm XTRA), Broadcom PSDS cache, Samsung PSDS cache, Qualcomm PSDS (XTRA) cache, SUPL proxy, attestation key provisioning proxy, Vanadium component update check/download proxy, network location proxy and geocoding proxy. Also app and OS updates via an include.

GrapheneOS / Auditor

Hardware-based attestation and intrusion detection app for Android. It provides both local verification with another Android device via QR codes and optional scheduled server-based verification with support for alert emails. It uses hardware-backed keys and attestation support as the foundation and chains trust to the app for software checks.

google / oss-rebuild

Securing open-source package ecosystems by originating, validating, and augmenting build attestations.

chainloop-dev / chainloop

Agentic SDLC infrastructure. Define guardrails. Collect signals. Enforce continuously. Signed records of what your AI coding agents and CI/CD pipelines did, checked against policies as code, with the loop closed in CI/CD. AI sessions, SBOMs, VEX, SARIF and SLSA provenance, built on Sigstore and in-toto. Apache 2.0.

keylime / keylime

A CNCF Project to Bootstrap & Maintain Trust on the Edge / Cloud and IoT

in-toto / witness

Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.

Stellar-Pathfinder / stellar-pathfinder

A corridor-integrity monitor for the Stellar network. Prices stablecoin→fiat-token corridors, scores routes against independent reference rates, and refuses to recommend when all options are unusable. Features wallet integration (Freighter/Albedo) and on-chain attestations via Soroban smart contracts.

TLAY-IO / boat-mer

Lightweight C runtime for connected machines: on-device identity, attestation, and BLE-native per-slice stablecoin payment primitives. Apache-2.0.

VD171 / VD-Google

Your Google services (RCS, Google Wallet, DroidGuard timestamps, Play Integrity attestations, Play Protect Certification) read on-device. No internet, root required.

quarkslab / android-hardware-attestation-demo

An Android HW Attestation demo

reveny / Android-Device-Trust

Android device attestation and fingerprinting tool

hhh7666 / receipt-protocol

Minimal Ed25519-signed activity receipts for verifiable AI agents — self-attested, offline-verifiable, no blockchain.

DavidBuchanan314 / keystork

Android attestation bypass toolkit (WIP, contains vibeslop)