本页面中的信息并不完全以您的首选语言展示，我们正在完善其他语言版本。想要以您的首选语言了解相关信息，可以点击这里下载PDF。
发布于 : Nov 14, 2018
不在本期内容中
这一条目不在当前版本的技术雷达中。如果它出现在最近几期中，那么它很有可能仍然具有相关参考价值。如果这一条目出现在更早的雷达中，那么它很有可能已经不再具有相关性，我们的评估将不再适用于当下。很遗憾我们没有足够的带宽来持续评估以往的雷达内容。
了解更多
Nov 2018
评估
We're continually on the lookout for tools and techniques that allow delivery teams to work independently from the rest of a larger organization while staying within its security and risk guardrails. Grafeas is such a tool. It lets organizations publish authoritative metadata about software artifacts—Docker images, libraries, packages—that is then accessible from build scripts or other automated compliance controls. The access control mechanisms allow for a separation of responsibility between the teams that publish approvals or vulnerabilities and the teams that build and deploy software. Although several organizations, including Google and JFrog, use Grafeas in their workflows, note that the tool is still in alpha.
