grafeas
notation
| grafeas | notation | |
|---|---|---|
| 3 | 7 | |
| 1,502 | 292 | |
| 0.7% | 2.1% | |
| 5.8 | 8.9 | |
| 29 days ago | 8 days ago | |
| Go | Go | |
| Apache License 2.0 | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
grafeas
-
Securing CI/CD Images with Cosign and OPA
Grafeas: While Grafeas offers a comprehensive solution for the software development lifecycle, it is not designed for public or open-source software (OSS) image verification. It's better suited for first-party integration, particularly with Google Kubernetes Engine (GKE).
-
Open source container scanning tool to find vulnerabilities and suggest best practice improvements?
https://github.com/grafeas/grafeas 1.4k stars, updated last week
-
Anyone else using Universal Resource Names (URN) for Asset Tracking and Automation?
Yes I have been looking at this notably related to relationships to vulnerabilities and leveraging grafeas. Which uses a resource uri to relate to a container but could equally be an os on a host. As we use azure, aws, google and have on premise I agree makes some sense to do this. My use case is somewhat easier as DNS names make some sense but the base part of resource has to indicate it is on premise and has to name space independent of the cloud so using the core company DNS name in a similar way the cloud providers do. Other than that looking to leverage many of concepts in grafeas.
notation
-
Securing CI/CD Images with Cosign and OPA
Notary v2: The evolution to Notary v2 brought improvements in signature portability and integration with third-party key management solutions. However, it does not provide a certificate authority, leaving public key discovery for open-source image verification as an unresolved issue.
-
Automating Kubernetes Deployments with FluxCD for Patched and Signed Container Images
Notation
-
Level-up Container Security: 4 Open-Source Tools for Secure Software Supply Chain
Notation is another command-line too that lets you digitally sign artifacts. And those signatures essentaily become the stamps of approval for the different things in your software supply chain. For example, container images.
- notaryproject/notation: Notation is a project to add signatures as standard items in the registry ecosystem, and to build a set of simple tooling for signing and verifying these signatures. Based on Notary V2 standard.
-
Getting Started with Notary
Notary is the CNCF project name and is often referenced when referring to the process of signing digital artifacts, but Notation is the command line tool that does the heavy lifting. Run the following commands to install Notation.
- Dagger: a new way to build CI/CD pipelines
-
Making the Internet more secure one signed container at a time
It should be interoperable, that's the goal. I proposed some idea for nv2 here: https://github.com/notaryproject/nv2/issues/39 and here: https://github.com/notaryproject/nv2/issues/40 too.
What are some alternatives?
dagda - a tool to perform static analysis of known vulnerabilities, trojans, viruses, malware & other malicious threats in docker images/containers and to monitor the docker daemon and running docker containers for detecting anomalous activities
cosign - Code signing and transparency for containers and binaries
vimp - Compare data from multiple vulnerability scanners to get a more complete picture of potential exposures.
net-monitor - The sample net-monitor software, used as samples in Notary v2 (https://github.com/notaryproject/notaryproject)
trivy - Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
ratify - Artifact Ratification Framework
grype - A vulnerability scanner for container images and filesystems
secure-supply-chain-on-aks - Learn how to use open-source tools to secure your container deployments on Azure Kubernetes Service.
distribution - distribution with reference types
Dagger2 - A fast dependency injector for Android and Java.
dagster - An orchestration platform for the development, production, and observation of data assets.
cuetorials.com - Learn you some CUE for a great good!