oracle/macaron

View on GitHub

Macaron is an extensible supply-chain security analysis framework from Oracle Labs that supports a wide range of build systems and CI/CD services. It can be used to prevent supply chain attacks, detect malicious Python packages, or check conformance to frameworks, such as SLSA. Documentation:

Stars: 210
Forks: 36
Open beginner issues: 0
Indexed issues: 105
Avg merge: 1d 10h
Merged PRs (30d): 2

Dominant language: Python
License: UPL-1.0
Last GitHub push: Sep 9, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: No beginner labels indexed

Beginner friendly Everything

Open All

105 open issues indexed

RepoVerifierMaven raises IndexError for a group id with fewer than three segments Open

Difficulty 2/5 1-3 hours Newbie friendliness 35/100

oracle/macaron#1463 · Opened Sep 6, 2026
[Feature Request] - [Pre-check package availability] Open

enhancement feature

Difficulty 4/5 3-5 days Newbie friendliness 55/100

oracle/macaron#1462 · Opened Sep 4, 2026
Review `# type: ignore` comments across the code base. Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

oracle/macaron#1423 · Opened Jun 22, 2026
[Feature Request] - [Allow suppressing some of the GitHub Action check findings] Open

enhancement feature github_actions macaron_action

Difficulty 5/5 Over a week Newbie friendliness 35/100

oracle/macaron#1382 · Opened Apr 22, 2026
Review pylint plugins and their notes. Open

Difficulty 4/5 3-5 days Newbie friendliness 42/100

oracle/macaron#1354 · Opened Apr 9, 2026
[Feature Request] - [Improve buildspec generation and error handling for missing metadata] Open

build_spec_generation enhancement feature

Difficulty 5/5 Over a week Newbie friendliness 45/100

oracle/macaron#1353 · 5 comments · Opened Apr 9, 2026
[Enhancement Request] - [Build specs overwriting and path sanitization overlaps due to incomplete purl/version handling] Open

build_spec_generation enhancement

oracle/macaron#1307 · 1 assignee · Opened Feb 17, 2026
[Bug] - [Dataflow analysis crashes on invalid or malformed GitHub Actions workflows] Open

bug github_actions

oracle/macaron#1306 · 1 assignee · Opened Feb 17, 2026
[Enhancement] - Verify local provenance Open

enhancement slsa-provenance

oracle/macaron#1158 · 1 assignee · Opened Aug 19, 2025
[Bug] - maintainer package HTML page is not being returned successfully Open

bug malware analysis python

Difficulty 4/5 3-5 days Newbie friendliness 35/100

oracle/macaron#1147 · 2 comments · Opened Aug 8, 2025
Improve the SCM Authenticiy check for end users Open

enhancement

oracle/macaron#1132 · 1 assignee · Opened Jul 22, 2025
Use a temporary file for testing defaults.ini content loading in test_pypi_sourcecode_analyzer.py Open

tests

oracle/macaron#1108 · 1 reaction · 1 assignee · Opened Jun 19, 2025
Attestation is redundantly downloaded into temporary files Open

enhancement slsa-provenance

Difficulty 4/5 3-5 days Newbie friendliness 35/100

oracle/macaron#1095 · Opened Jun 3, 2025
[Feature Request] - Include more GitHub Actions metadata for each build command Open

build_from_source checks enhancement feature

Difficulty 4/5 3-5 days Newbie friendliness 35/100

oracle/macaron#1090 · Opened May 21, 2025
[Feature Request] - Add model for setup-python GitHub Action Open

build_tools enhancement feature python

Difficulty 3/5 1-2 days Newbie friendliness 45/100

oracle/macaron#1082 · Opened May 19, 2025
[Bug] - The build command's JDK version is reported incorrectly for pkg:maven/org.apache.hugegraph/computer-k8s@1.0.0 Open

bug triage

Difficulty 3/5 1-2 days Newbie friendliness 48/100

oracle/macaron#1077 · Opened May 9, 2025
[Bug] - The action_version attribute of Setup Language classes are not initialized Open

bug triage

Difficulty 2/5 1-3 hours Newbie friendliness 55/100

oracle/macaron#1076 · Opened May 9, 2025
[Enhancement Request] - Improve debug messages for irrelevant workflow in some checks Open

enhancement feature

Difficulty 3/5 1-2 days Newbie friendliness 45/100

oracle/macaron#1075 · Opened May 9, 2025
Tutorial on integrating Macaron with CI/CD pipelines using GitHub Actions and GitLab CI/CD. Open

documentation enhancement feature

Difficulty 3/5 1-2 days Newbie friendliness 35/100

oracle/macaron#1053 · 1 reaction · Opened Apr 14, 2025
Error and Skip Handling in Heuristic Malware Analysis Open

enhancement malware analysis

Difficulty 4/5 3-5 days Newbie friendliness 38/100

oracle/macaron#1052 · 1 comment · Opened Apr 14, 2025
Create ARM-compatible wheel file for Macaron python package Open

enhancement feature

Difficulty 4/5 3-5 days Newbie friendliness 35/100

oracle/macaron#1050 · Opened Apr 8, 2025
Add a new sub-command to dump useful information from the database Open

cli enhancement feature user_experience

oracle/macaron#1039 · 1 assignee · Opened Apr 4, 2025
pkg:maven/com.simplaex/java-druid-client@1.2.0 got UNKNOWN for mcn_scm_authenticity_1, expect FAILED Open

bug checks

Difficulty 3/5 1-2 days Newbie friendliness 35/100

oracle/macaron#1026 · Opened Mar 25, 2025
refactor SourceCodeRepo heuristic Open

checks malware analysis

oracle/macaron#990 · 1 assignee · Opened Feb 13, 2025
Support Recursive Calls to Bash Scripts within Jenkinsfiles Open

static analysis

Difficulty 4/5 3-5 days Newbie friendliness 35/100

oracle/macaron#978 · Opened Feb 6, 2025
Wrong deploy commands reported by the build as code check for pkg:maven/dev.sigstore/sigstore-maven-plugin@1.0.0 Open

bug

oracle/macaron#937 · 1 assignee · Opened Dec 5, 2024
Create a tutorial for using the local maven repo Open

Difficulty 3/5 1-2 days Newbie friendliness 30/100

oracle/macaron#936 · Opened Dec 4, 2024
Rename the integration test case directories that mention yaml input Open

tests

Difficulty 1/5 Under an hour Newbie friendliness 45/100

oracle/macaron#929 · Opened Nov 26, 2024
The values stored within some CheckFacts instances are not consistent. Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

oracle/macaron#891 · Opened Oct 2, 2024
Enable optional pylint plugins. Open

code quality enhancement

Difficulty 3/5 1-2 days Newbie friendliness 35/100

oracle/macaron#876 · 4 comments · Opened Sep 29, 2024
Add support for Python packages built from Rust Open

build_tools

Difficulty 5/5 Over a week Newbie friendliness 28/100

oracle/macaron#875 · 1 comment · 1 reaction · Opened Sep 29, 2024
Discuss OpenChain and ISO compliance Open

checks Policy

Difficulty 5/5 Over a week Newbie friendliness 25/100

oracle/macaron#870 · 1 comment · Opened Sep 23, 2024
Add an integration test for checking Sonatype API version Open

oracle/macaron#869 · 1 assignee · Opened Sep 23, 2024
Host policies for VSAs of SLSA Build Levels Open

policy engine vsa

Difficulty 5/5 Over a week Newbie friendliness 25/100

oracle/macaron#837 · Opened Aug 21, 2024
Add support for Makefile as build script and make as build tool Open

build_tools

Difficulty 4/5 3-5 days Newbie friendliness 35/100

oracle/macaron#833 · 2 comments · Opened Aug 19, 2024
Cli option to skip cloning the repo Open

cli repository_finder

Difficulty 4/5 3-5 days Newbie friendliness 28/100

oracle/macaron#823 · Opened Aug 13, 2024
Add a consistency check that compares release artifact files & version number and files at a release commit Open

checks

Difficulty 4/5 3-5 days Newbie friendliness 35/100

oracle/macaron#808 · Opened Jul 31, 2024
Improve PyPI malware detector to reduce false positives Open

checks enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

oracle/macaron#801 · 1 comment · Opened Jul 23, 2024
Add support for provenance discoverable on Maven Central Open

enhancement slsa-provenance

oracle/macaron#792 · 1 assignee · Opened Jul 15, 2024
Check policy in VSA against user policy Open

policy engine vsa

Difficulty 5/5 Over a week Newbie friendliness 25/100

oracle/macaron#787 · Opened Jul 8, 2024
Improve documentation of checks Open

documentation

Difficulty 4/5 3-5 days Newbie friendliness 35/100

oracle/macaron#751 · Opened May 26, 2024
Explore support for GraalVM Native image Open

integration

Difficulty 5/5 Over a week Newbie friendliness 25/100

oracle/macaron#746 · Opened May 21, 2024
What is the best way to represent complicated expectation for the provenance Open

policy engine provenance expectations user_experience

oracle/macaron#733 · 1 assignee · Opened May 9, 2024
Obtain the triggering build workflows from provenances for static analysis Open

build_tools checks

Difficulty 4/5 3-5 days Newbie friendliness 35/100

oracle/macaron#730 · Opened May 3, 2024
Report via check when a project does not use semantic versioning Open

oracle/macaron#728 · 3 comments · 1 assignee · Opened May 2, 2024
Create a Macaron release image for the Arm architecture Open

release

Difficulty 4/5 3-5 days Newbie friendliness 20/100

oracle/macaron#648 · 2 comments · Opened Feb 20, 2024
Improve checks registering and scheduling Open

checks code quality

Difficulty 5/5 Over a week Newbie friendliness 20/100

oracle/macaron#645 · 1 reaction · Opened Feb 18, 2024
Enforce size limit or timeout while parsing target configurations Open

code quality

Difficulty 4/5 3-5 days Newbie friendliness 30/100

oracle/macaron#630 · Opened Feb 7, 2024
Macaron plugins for text editors Open

integration

Difficulty 5/5 Over a week Newbie friendliness 25/100

oracle/macaron#623 · Opened Feb 2, 2024
Unintuitive behavior of the provenance expectation check Open

provenance expectations

oracle/macaron#595 · 2 comments · 1 reaction · 1 assignee · Opened Jan 9, 2024

oracle/macaron

Get new issues in your inbox