GUAC aggregates software security metadata into a high fidelity graph database.

Evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

A Go implementation of in-toto. in-toto is a framework to protect software supply chain integrity.

Enabling Software Supply Chain Security Capabilities in ArgoCD

Github Action implementation of SLSA Provenance Generation

Go implementation for CNAB content trust verification using TUF, Notary, and in-toto

Prototype in-toto attestation verifier based on ITE-10 and ITE-11 layouts

Library to create, verify, and evaluate policy for attestations on container images

Programmatically running in-toto verifications in a container