Sigstore & cosign

Grafeas

Grafeas is an open API for managing and auditing software supply chain metadata.

About

Grafeas provides an open artifact metadata API designed to audit and govern software supply chains. It offers a standardized representation of metadata across various stages of the software lifecycle, including source, build, and deployment. Users can store, query, and analyze metadata for different software artifacts, regardless of their type or location. The API supports complex queries to help identify vulnerabilities and compliance issues within the software supply chain.

Resources & Links

Related Categories