Tooling and library for generation, validation and verification of supply chain metadata documents and frameworks

GUAC aggregates software security metadata into a high fidelity graph database.

Supply-chain Levels for Software Artifacts

A specification for signing methods and formats used by Secure Systems Lab projects.