{"id":9603,"date":"2017-10-12T19:51:07","date_gmt":"2017-10-12T19:51:07","guid":{"rendered":"https:\/\/rsoftsolution.com\/blog\/google-ibm-and-others-launch-an-open-source-api-for-keeping-tabs-on-software-supply-chains.html"},"modified":"2017-10-12T19:51:07","modified_gmt":"2017-10-12T19:51:07","slug":"google-ibm-and-others-launch-an-open-source-api-for-keeping-tabs-on-software-supply-chains","status":"publish","type":"post","link":"https:\/\/www.rbsitsoftwaresolution.in\/blog\/google-ibm-and-others-launch-an-open-source-api-for-keeping-tabs-on-software-supply-chains.html","title":{"rendered":"Google, IBM and others launch an open-source API for keeping tabs on software supply chains"},"content":{"rendered":"


\n<\/p>\n

Thanks to containers and microservices, the way we are building software is quickly changing. But as with all change, these new models also introduce new problems. You probably still want to know who actually built a given container and what\u2019s running in it. To get a handle on this, Google,\u00a0JFrog<\/span>, Red Hat, IBM, Black Duck, Twistlock, Aqua Security and CoreOS today announced Grafeas<\/a> (\u201cscribe\u201d in Greek), a new joint open-source project that provides users with a standardized way for auditing and governing their software supply chain.<\/p>\n

In addition, Google also launched another new project, Kritis (\u201cjudge\u201d in Greek, because after the success of Kubernetes, it would surely be bad luck to pick names in any other language for new Google open-source projects). Kritis allows businesses to enforce certain container properties at deploy time for Kubernetes clusters.<\/p>\n

\"\"<\/a><\/p>\n

Grafeas basically defines an API that collects all of the metadata around code deployments and build pipelines. This means keeping a record of authorship and code provenance, recording the deployment of each piece of code, marking whether code passed a security scan, which components it uses (and whether those have known vulnerabilities) and whether QA signed off on it. So before a new piece of code is deployed, the system can check all of the info about it through the Grafeas API and if it\u2019s certified and free of vulnerabilities (at least to the best knowledge of the system), then it can get pushed into production.<\/p>\n

At first glance, this all may seem\u00a0rather bland, but there\u2019s a real need for projects like this. With the advent of continuous integration, decentralization, microservices, an increasing number of toolsets and every other buzzworthy technology, enterprises are struggling to keep tabs on what\u2019s actually happening in their data centers. It\u2019s pretty hard to stick to your security and governance policies if you don\u2019t exactly know what software you\u2019re actually running. Currently, all of the different tools that developers use can record their own data, of course, but Grafeas represents an agreed-upon way for collecting and accessing this data across tools.<\/p>\n

Like so many of Google\u2019s open-source projects, Grafeas basically mimics how Google itself handles these issues. Thanks to its massive scale and early adoption of containers and microservices, Google, after all, saw many of these problems long before they became an issue for the industry at large. As Google notes in today\u2019s announcement, the basic tenants of Grafeas reflect the best practices that Google itself developed for its build systems.<\/p>\n

All of the various partners involved here are bringing different pieces to the table, but JFrog, for example, will implement this system in its Xray API<\/a>. Red Hat will use it to enhance its security and automation features in OpenShift (its container platform) and CoreOS will integrate it into its Tectonic Kubernetes platform.<\/p>\n

\"\"<\/a><\/p>\n

One of the early testers of Grafeas is Shopify, which currently builds about 6,000 containers per day and which keeps 330,000 images in its primary container registry. With Grafeas, it can now know whether a given container is currently being used in production, for example, when it was downloaded from the registry, what packages are running in it and whether any of the components in the container include any known security vulnerabilities.<\/p>\n

\u201cUsing Grafeas as the central source of truth for container metadata has allowed the security team to answer these questions and flesh out appropriate auditing and lifecycling strategies for the software we deliver to users at Shopify,\u201d the company writes in today\u2019s announcement.<\/p>\n

<\/p>\n

Article source: http:\/\/feedproxy.google.com\/~r\/techcrunchIt\/~3\/PJC3TChXo3k\/<\/p>","protected":false},"excerpt":{"rendered":"

Thanks to containers and microservices, the way we are building software is quickly changing. But as with all change, these new models also introduce new problems. You probably still want <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[19],"tags":[25],"class_list":["post-9603","post","type-post","status-publish","format-standard","hentry","category-enterprise-software","tag-enterprise"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t