Periodic Table
The software supply chain, laid out so position means something.
Twenty-five domains, 348 products, laid out in the order the chain runs. Open one to see its controls arranged by the program maturity each demands, how much of the modeled threat it closes, and who actually sells it.
Table
← All 25 domains
10Build Integrity & Cryptographic Trust
19 shown
For any artifact in production, can we cryptographically prove which commit, which build platform and which inputs produced it?
Who maintains it
- Foundation10
- Community1
- Company8
Open Source
13 here
- Arc133Archivista2 capabilities
- Baz134Bazel2 capabilities
- Nnp135Notation (Notary Project)3 capabilities
- Sgg136SLSA GitHub Generator2 capabilities
- Sco137Sigstore Cosign5 capabilities
- Sf138Sigstore Fulcio2 capabilities
- Sr139Sigstore Rekor2 capabilities
- Tc140Tekton Chains3 capabilities
- Wit141Witness3 capabilities
- Dif142diffoscope2 capabilities
- Tot143in-toto2 capabilities
- Mel144melange3 capabilities
- Sv145slsa-verifier2 capabilities
Freemium
1 here
How this was produced
Every figure above was read from the Gantry knowledge graph, version 7.1.0, and computed when you opened this page — in 357 ms on 2026-10-27. Nothing here is a cached verdict or a dataset assembled for marketing: it is the same model our engagements run on.