README
¶
Grafeas: A Component Metadata API
Grafeas ("scribe" in Greek) is an open-source artifact metadata API that provides a uniform way to audit and govern your software supply chain. Grafeas defines an API spec for managing metadata about software resources, such as container images, Virtual Machine (VM) images, JAR files, and scripts. You can use Grafeas to define and aggregate information about your project's components. Grafeas provides organizations with a central source of truth for tracking and enforcing policies across an ever growing set of software development teams and pipelines. Build, auditing, and compliance tools can use the Grafeas API to store, query, and retrieve comprehensive metadata on software components of all kinds.
Grafeas divides the metadata information into notes and occurrences. Notes are high-level descriptions of particular types of metadata. Occurrences are instantiations of notes, which describe how and when a given note occurs on the resource associated with the occurrence. This division allows third-party metadata providers to create and manage metadata on behalf of many customers. It also allows for fine-grained access control of different types of metadata.
Getting Started
- Read the Grafeas announcement
- Learn the Grafeas concepts and core design principles
- Run Grafeas locally following these instructions
- Once you have a running server, you can use the client libraries to experiment with creating notes and occurrences in Grafeas. There are client libraries available in Java, Go, Ruby, and Python.
- The authoritative API for grafeas is the protobuf files.
Support
If you have questions, reach out to us on grafeas-users. For questions about contributing, please see the section below or use grafeas-dev.
Grafeas announcements will be posted to its @grafeasio Twitter account and to grafeas-users.
Contributing
See CONTRIBUTING for details on how you can contribute.
See DEVELOPMENT for details on the development and testing workflow.
License
Grafeas is under the Apache 2.0 license. See the LICENSE file for details.
Directories
¶
| Path | Synopsis |
|---|---|
|
go
|
|
|
errors
Package errors contains utils for returning gRPC errors from the Grafeas API.
|
Package errors contains utils for returning gRPC errors from the Grafeas API. |
|
filtering/ast
package ast provides methods for constructing CEL abstract syntax nodes.
|
package ast provides methods for constructing CEL abstract syntax nodes. |
|
filtering/common
package common defines types common to parsing and other diagnostics.
|
package common defines types common to parsing and other diagnostics. |
|
filtering/operators
package operators defines constant operator names and helper functions for identifying the operator and its kind.
|
package operators defines constant operator names and helper functions for identifying the operator and its kind. |
|
filtering/parser
package parser provides methods to parse filter sources to CEL-based ASTs.
|
package parser provides methods to parse filter sources to CEL-based ASTs. |
|
iam
Package iam defines types that are used in IAM related methods.
|
Package iam defines types that are used in IAM related methods. |
|
name
Package name deals with parsing and formatting resource names used in the Grafeas API.
|
Package name deals with parsing and formatting resource names used in the Grafeas API. |
|
v1/api
Package grafeas is an implementation of the v1 https://github.com/grafeas/grafeas/ API.
|
Package grafeas is an implementation of the v1 https://github.com/grafeas/grafeas/ API. |
|
v1/api/validators/attestation
Package attestation implements functions to validate that the fields of attestation entities being passed into the API meet our requirements.
|
Package attestation implements functions to validate that the fields of attestation entities being passed into the API meet our requirements. |
|
v1/api/validators/build
Package build implements functions to validate that the fields of build entities being passed into the API meet our requirements.
|
Package build implements functions to validate that the fields of build entities being passed into the API meet our requirements. |
|
v1/api/validators/deployment
Package deployment implements functions to validate that the fields of deployment entities being passed into the API meet our requirements.
|
Package deployment implements functions to validate that the fields of deployment entities being passed into the API meet our requirements. |
|
v1/api/validators/discovery
Package discovery implements functions to validate that the fields of discovery entities being passed into the API meet our requirements.
|
Package discovery implements functions to validate that the fields of discovery entities being passed into the API meet our requirements. |
|
v1/api/validators/grafeas
Package grafeas implements functions to validate that the fields of Grafeas entities being passed into the API meet our requirements.
|
Package grafeas implements functions to validate that the fields of Grafeas entities being passed into the API meet our requirements. |
|
v1/api/validators/image
Package image implements functions to validate that the fields of image entities being passed into the API meet our requirements.
|
Package image implements functions to validate that the fields of image entities being passed into the API meet our requirements. |
|
v1/api/validators/package
Package pkg implements functions to validate that the fields of package entities being passed into the API meet our requirements.
|
Package pkg implements functions to validate that the fields of package entities being passed into the API meet our requirements. |
|
v1/api/validators/provenance
Package provenance implements functions to validate that the fields of provenance entities being passed into the API meet our requirements.
|
Package provenance implements functions to validate that the fields of provenance entities being passed into the API meet our requirements. |
|
v1/api/validators/vulnerability
Package vulnerability implements functions to validate that the fields of vulnerability entities being passed into the API meet our requirements.
|
Package vulnerability implements functions to validate that the fields of vulnerability entities being passed into the API meet our requirements. |
|
v1beta1/api
Package grafeas is an implementation of the v1beta1 https://github.com/grafeas/grafeas/ API.
|
Package grafeas is an implementation of the v1beta1 https://github.com/grafeas/grafeas/ API. |
|
v1beta1/api/validators/attestation
Package attestation implements functions to validate that the fields of attestation entities being passed into the API meet our requirements.
|
Package attestation implements functions to validate that the fields of attestation entities being passed into the API meet our requirements. |
|
v1beta1/api/validators/build
Package build implements functions to validate that the fields of build entities being passed into the API meet our requirements.
|
Package build implements functions to validate that the fields of build entities being passed into the API meet our requirements. |
|
v1beta1/api/validators/deployment
Package deployment implements functions to validate that the fields of deployment entities being passed into the API meet our requirements.
|
Package deployment implements functions to validate that the fields of deployment entities being passed into the API meet our requirements. |
|
v1beta1/api/validators/discovery
Package discovery implements functions to validate that the fields of discovery entities being passed into the API meet our requirements.
|
Package discovery implements functions to validate that the fields of discovery entities being passed into the API meet our requirements. |
|
v1beta1/api/validators/grafeas
Package grafeas implements functions to validate that the fields of Grafeas entities being passed into the API meet our requirements.
|
Package grafeas implements functions to validate that the fields of Grafeas entities being passed into the API meet our requirements. |
|
v1beta1/api/validators/image
Package image implements functions to validate that the fields of image entities being passed into the API meet our requirements.
|
Package image implements functions to validate that the fields of image entities being passed into the API meet our requirements. |
|
v1beta1/api/validators/package
Package pkg implements functions to validate that the fields of package entities being passed into the API meet our requirements.
|
Package pkg implements functions to validate that the fields of package entities being passed into the API meet our requirements. |
|
v1beta1/api/validators/provenance
Package provenance implements functions to validate that the fields of provenance entities being passed into the API meet our requirements.
|
Package provenance implements functions to validate that the fields of provenance entities being passed into the API meet our requirements. |
|
v1beta1/api/validators/vulnerability
Package vulnerability implements functions to validate that the fields of vulnerability entities being passed into the API meet our requirements.
|
Package vulnerability implements functions to validate that the fields of vulnerability entities being passed into the API meet our requirements. |
|
proto
|
|
Click to show internal directories.
Click to hide internal directories.