Grafeas
An open-source artifact metadata API for auditing and governing software supply chains.
What is Grafeas?
Grafeas is an open-source artifact metadata API that provides a uniform way to audit and govern software supply chains. It defines an API specification for managing metadata about software resources like container images, VM images, and JAR files, offering organizations a central source of truth for tracking and enforcing policies across development teams and pipelines.
Platform engineers, DevOps teams, and security professionals who need to aggregate, audit, and enforce policies on metadata across diverse software components in their supply chain.
Grafeas offers a standardized, vendor-agnostic API that separates high-level metadata descriptions (notes) from their instantiations (occurrences), enabling fine-grained access control and allowing third-party providers to manage metadata on behalf of many customers.
Overview
Artifact Metadata API
Use Cases
Best For
- Centralizing metadata for auditing and compliance across container images, VM images, and other artifacts.
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
