Chainloop vs GUAC

Chainloop centralizes software delivery artifacts and evidence to support security, compliance and visibility across the delivery process. Its evidence store can hold metadata for SBOMs, QA reports, vulnerability scans and legal reviews. It connects metadata and artifacts in a graph, providing provenance and context for control gates, quality checks and compliance dashboards. The CLI and integrations capture evidence from CI/CD pipelines, including Git commit details and pipeline configuration. Documentation describes signing metadata with SLSA, in-toto, Sigstore or customer PKI such as AWS KMS or Keyfactor. Deployment options include cloud and self-managed setups, including on-premises and airgapped environments. The paid platform adds curated policies and frameworks such as SLSA, SSDF, CRA, DORA and NIS2. Community Edition costs nothing, is free and open source, and is self-hosted with community support; it has no UI or curated policy library. The enterprise Chainloop Platform has pricing available by contacting the maker and lists dedicated support.

GUAC ingests software metadata, including software bills of materials, and connects it into a queryable view of supply-chain relationships. That portfolio-level view lets developers, operations and security practitioners, and Open Source Program Offices examine dependencies across software rather than one SBOM at a time. Teams can look for vulnerable, deprecated, unsupported, or duplicated dependencies and identify risky upstreams using OpenSSF Scorecard. APIs and a visualization tool support queries and exploration. GUAC documents SPDX and CycloneDX SBOM formats, with graph enrichment from OSV for vulnerability data, ClearlyDefined for license information, and Deps.dev for dependency information. Its GraphQL server can use in-memory storage or PostgreSQL for persistence. Collectors can read or watch files, storage buckets, and Git repositories; the filesystem collector is stable, while other collectors are experimental. Setup uses Docker Compose and requires Docker, Docker Compose, and jq. The project is an OpenSSF Incubating Project. GUAC is free and open source: its code is under the MIT license, and documentation content is under CC BY 4.0.