A curated catalogue of OSS libraries across npm, PyPI, Maven, Go, Cargo, and RubyGems — rebuilt with patched transitive dependencies, signed with sigstore, attested in-toto, and shipped through your existing package manager. Drop-in semantics; provenance built in.
Same module names, same APIs, same lockfile shape. The difference is the dependency graph beneath — patched, signed, and provenance-backed.
npm, PyPI, Maven, Go modules, Cargo, and RubyGems. Each catalogue entry is a real OSS library you already depend on, rebuilt with patched transitive dependencies — same module name, same API.
When a library you depend on ships a transitive with a known CVE that upstream hasn't fixed, our build re-pins the dependency to a patched version and republishes. The original semantics, minus the CVE.
Every published package carries a sigstore signature and an in-toto attestation pointing at the source commit, the build platform, and the patch set applied. Reproducible, verifiable, auditable.
Run the CLI against your existing package.json, requirements.txt, pom.xml, go.mod, Cargo.toml, or Gemfile and get a generated lockfile that pins to the vetted variants where they exist, the original upstream where they don't.
Configure your registry to fall back through the Safeguard mirror. npm install, pip install, mvn install, go get, cargo build, bundle install — no syntax change for the engineer, no new CLI to learn.
Each library in the catalogue ships with a stated patch SLA — most are under 48 hours from upstream disclosure. The SLA is tracked against actual delivery and published as a rolling time-series.
Search for the libraries you already depend on. Each entry shows the upstream version, the patches applied, the SBOM, and the signature.
One config line: an .npmrc entry, a pip index URL, a Maven settings.xml mirror, a Go GOPROXY value. Your package manager keeps working as it does today.
Run the Safeguard CLI lockfile generator. The output pins to vetted variants for libraries we cover; upstream is used for the rest.
Configure your install step to check signatures. Unsigned packages fail closed. The verification key is pinned, so a compromise of the public registry doesn't matter.
Subscribe to the libraries you pulled. New patched versions notify your team, with the CVE delta and an upgrade command for your package manager.
Browse the catalogue, run the lockfile generator against one of your repos, and see how many CVEs disappear in a single mirror change.