Side by side
GUAC vs Sigstore
Both stand on software supply chain security software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan Open source APILinuxMac+3
GUAC connects SBOM and related metadata for portfolio-level supply-chain analysis, with APIs, visualization, and multiple enrichment sources. Its setup prerequisites and experimental collectors are worth noting.
Visit GUAC
Free plan Open source APILinuxMac+3
Sigstore brings artifact signing, identity authentication and a public transparency log into one project. Cosign's stated integration caveats matter for teams considering it inside an application.
Visit SigstoreThe facts
| GUAC | Sigstore | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Yes | Yes |
| Runs on | API, Linux, Mac, Self-hosted, Web, Windows | API, Linux, Mac, Self-hosted, Web, Windows |
| Lowest paid plan | Free or on request | Free or on request |
| Plans published | 2 | 2 |
| Maker | Not published | Not published |
| Website | guac.sh | sigstore.dev |
| On software supply chain security software | #1 of 24 | #2 of 24 |
GUAC: what it does well
- Queries relationships across a software portfolio.
- Supports SPDX and CycloneDX SBOMs.
- Enriches data with OSV, ClearlyDefined, and Deps.dev.
- GraphQL storage can use PostgreSQL.
What to know first
- Setup requires Docker, Docker Compose, and jq.
- Collectors other than the filesystem collector are experimental.
Sigstore: what it does well
- Signs and verifies multiple software artifact types.
- Uses temporary keys rather than developer-managed keys.
- Records signing events in a public tamper-resistant log.
- Provides GitHub Actions and documents GitLab CI.
- Free to use for developers and software providers.
What to know first
- Cosign has no API stability guarantees.
- Cosign does not follow semantic versioning.
- Cosign is not recommended for application integration.
Alternatives to GUAC Alternatives to Sigstore The whole list