GUAC
7.5#2 in software supply chain security softwareFree planFree planWebAPILinuxmacOS
VisitGUAC vs Sigstore
What both publish
| Fact | GUAC | Sigstore |
|---|---|---|
| API stability | The documented GraphQL definitions are explicitly described as unstable and subject to future code changes. | Sigstore classifies interfaces as Experimental, Beta or Generally Available, with best-effort deprecation notice periods of zero, two months or six months respectively. |
| Purpose | GUAC ingests software metadata such as SBOMs and maps relationships between software to provide supply chain security insights. | Sigstore is an open source project for improving software supply chain security. |
| Self-hosting | GUAC is deployed locally or in user-controlled infrastructure with Docker Compose and optional PostgreSQL persistence. | Sigstore provides scaffolding for running a full stack in Kubernetes, including KinD, and offers Google Cloud Terraform modules. |
GUAC plans
- GUAC (open-source project)Free
- Open-source GUACFree
Sigstore plans
- FreeFree
- Public-good Sigstore serviceFree
Pick GUAC if…
GUAC suits development, operations, and security teams, as well as Open Source Program Offices, that need to explore software dependencies across a portfolio. It is relevant to teams already working with SBOMs and able to meet its Docker-based setup prerequisites.
Pick Sigstore if…
Sigstore suits developers and software providers seeking signing and verification workflows for software artifacts. It may also be relevant to package managers integrating signing into their tooling or registries.