config.yaml

baseURL: /
languageCode: en-us
publishDir: public/
canonifyURLs: true
title: guac
theme: hugo-fresh
googleAnalytics: G-VVPLWNX4L9
outputs:
  home:
    - html
  section:
    - html
    - rss
services:
  rss:
    limit: 10
markup:
  goldmark:
    renderer:
      unsafe: true # Allows you to write raw html in your md files
pagination:
  pagerSize: 10

params:
  date_format: "2006-01-02"
  include_footer: true
  # Open graph allows easy social sharing. If you don't want it you can set it to false or just delete the variable
  openGraph: true
  # Used as meta data; describe your site to make Google Bots happy
  description:
  navbarlogo:
  # Logo (from static/images/logos/___)
    image: logos/guac-logo-squareish.png
    link: /
    text: GUAC
  font:
    name: "Open Sans"
    sizes: [400,600]
  hero:
    # Main hero title
    title: Know your software supply chain
    # Hero subtitle (optional)
    subtitle: GUAC projects give you directed, actionable insights into the security of your software supply chain.

    # Hero image (from static/images/___)
    image: logos/guac-logo.png

  # Customizable navbar. For a dropdown, add a "sublinks" list.
  navbar:
  - title: GUAC
    url: /guac
  - title: Trustify
    url: /trustify
  - title: Community
    url: /community
  - title: Contributing
    url: /contributing
  - title: Blog
    url: /blog
  - title: Docs
    url: https://docs.guac.sh/
  - title: GitHub
    url: https://github.com/guacsec/
    button: true

  sectionProjects:
    title: GUAC projects 
  
    coreProjects:
    - title: GUAC
      logo: guac-logo.png
      text: GUAC (Graph for Understanding Artifact Composition) aims to fill in the gaps by ingesting software metadata, like SBOMs, and mapping out relationships between software. When you know how one piece of software affects another, you’ll be able to fully understand your software security position and act as needed.
      url: /guac
    - title: Trustify
      logo: trustify.png
      text: The Trustify project is a collection of software components that enables you to store and retrieve Software Bill of Materials (SBOMs), and advisory documents. Developers can use this information to learn about common security vulnerabilities and dependency changes within their software supply chain.
      url: /trustify

    additionalProjects:
    - title: sw-id-core
      url: https://github.com/guacsec/sw-id-core

  sectionCollab:
    title: In Open Source collaboration with
    orgsBig:
    - name: Google
      logo: google.png
      # <!-- logos at images/logos/ -->
      link: https://google.com/
    - name: Kusari
      logo: kusari.svg
      link: https://kusari.dev
    - name: Red Hat
      logo: red-hat.png
      link: https://redhat.com
    orgs:
    - name: Purdue University
      link: https://www.purdue.edu/
      logo: purdue.png
    - name: Citi
      link: https://www.citi.com/
      logo: citi.png
    - name: and many open source contributors...
      link: https://github.com/guacsec/guac/contributors

  section1:
    title: How GUAC can help you 
    subtitle: These are just a few examples of insights that GUAC can give you to improve your software security posture
    tiles:
    - title: Unveils gaps
      icon: binoculars
      texts:
      - text: Find the most used critical components in a software supply chain ecosystem
      - text: Track if all binaries in production trace back to a securely managed repository
      - text: Prevent supply chain compromises before they happen
      - text: Find exposures to risky dependencies
      url: https://github.com/guacsec/guac
      buttonText: Find GUAC
    - title: Compliance
      icon: check
      texts: 
      - text: Determine ownership of applications by organization
      - text: Look for evidence that the application you're about to deploy meets your organization's policies
      - text: Determine which application is missing SBOM or SLSA attestations
      - text: Conduct SBOM Diffs to quickly determine changes between versions
      url: https://github.com/guacsec/guac
      buttonText: Get GUAC
    - title: Threat Detection
      icon: skull-crossbones
      texts: 
      - text: Determine the blast radius of a bad package or a vulnerability and provide information and a patch plan towards remediation
      - text: Track a suspicious project lifecycle event back to when it was introduced
      - text: Obtain greater insight into vendor software vulnerabilities via VEX and project deprecation 
      url: https://github.com/guacsec/guac
      buttonText: Eat GUAC

  sectionOpenssf:
    title: GUAC is an OpenSSF Incubating Project!
    image: logos/openssf-incubating.png
    subtitle: The Graph for Understanding Artifact Composition (GUAC) maintainers are pleased to announce the project has joined the Open Source Security Foundation (OpenSSF) as an Incubating Project in the Supply Chain Integrity Working Group.
    buttonText: Learn More
    buttonLink: "https://openssf.org/projects/guac/"

  footer:
    # Logo (from /images/logos/___)
    logo: guac-logo-squareish.png
    # Social Media Title
    socialmediatitle: Follow GUAC
    # # Social media links (GitHub, Twitter, etc.). All are optional.
    socialmedia:
    #   # Icons are from Font Awesome
      - link: /blog/index.xml
        icon: rss
      - link: https://youtube.com/@guacsec
        icon: youtube
      - link: https://github.com/guacsec
        icon: github
    quicklinks:
      column1:
        title: "Community"
        titleLink: /community
      column2:
        title: "Blogs"
        titleLink: /blogs
      column3:
        title: "Demos"
        titleLink: https://docs.guac.sh/guac-use-cases/
      column4:
        title: "Docs"
        titleLink: https://docs.guac.sh/