Resources
Open source
The Surveyor CLI, the part of Spice Labs that runs on your machines and reads your software, is fully open source under the Apache License 2.0. You can read exactly what it does with your files, what it uploads and how it encrypts it, and build it yourself.
Projects
| Project | What it is |
|---|---|
| spice-labs-cli | The Surveyor CLI: the spice command, its installers and its Docker image. |
| goatrodeo | The analysis engine. It unpacks artifacts recursively and fingerprints every file it finds, building an Artifact Dependency Graph with OmniBOR identifiers. |
| ancho | The Java agent behind runtime surveys. It records calls to cryptographic methods with JDK Flight Recorder. |
| ginger-j | The encrypted uploader. It encrypts a survey on your machine and uploads it with the details in your Spice Pass. |
| bigtent | A fast, read-only server and library for Artifact Dependency Graphs. |
| action-spice-labs-surveyor | The GitHub Action that runs the Surveyor CLI in your workflows. See GitHub Actions. |
All of them are at github.com/spice-labs-inc.
Get involved
- Open an issue or a pull request on the project’s repository.
- Chat with the team and other users in the Matrix community room.
- Report a security problem privately to support@spicelabs.io rather than in a public issue.