1. @jbaruch @saturnism #OracleCodeOne #grafeas
One Metadata to Rule Them All: Open Approach to Metadata for Better Releases
The Grafeas Project
@jbaruch @saturnism #OracleCodeOne #grafeas

2. @jbaruch @saturnism #OracleCodeOne #grafeas
The speakers
@jbaruch
@saturnism
@jbaruch @saturnism #OracleCodeOne #grafeas

3. @jbaruch @saturnism #OracleCodeOne #grafeas
Do you Grafeas?
Never heard about Grafeas
Vaguely remember last year’s announcement
Know about it, follow the news
Use Grafeas
I am Vincent Tsao
@jbaruch @saturnism #OracleCodeOne #grafeas

4. @jbaruch @saturnism #OracleCodeOne #grafeas
Grafeas what?
API spec for managing metadata about software resources
Container images
VM images
JAR files
scripts
Define and aggregate information
@jbaruch @saturnism #OracleCodeOne #grafeas

5. @jbaruch #dockercon jfrog.com/shownotes
Unified metadata
Consume metadata from public sources
NVDB
Maven Central
Produce metadata about private packages
Jenkins
JFrog Xray
Combine metadata to product level
Make decisions in runtime
Kritis
@jbaruch #dockercon jfrog.com/shownotes

6. @jbaruch #dockercon jfrog.com/shownotes
Grafeas model
Note
Vulnerability
License
QA coverage
Occurrence
Instantiation of a note on an artifact
@jbaruch #dockercon jfrog.com/shownotes

7. @jbaruch #dockercon jfrog.com/shownotes
Component types
Debian
Docker
Maven
npm
NuGet
Python
rpm
Generic file
@jbaruch #dockercon jfrog.com/shownotes

8. @jbaruch #dockercon jfrog.com/shownotes
Anything beyond docs?
Reference implementation
JFrog Xray
Twistlock
@jbaruch #dockercon jfrog.com/shownotes

9. Q&A and twitter aids
@jbaruch
@saturnism
#OracleCodeOne
#grafeas