It's Dangerous To SLSA Alone Out There! Take This Artifact Knowledge Graph!
summary
A knowledge graph called guac ingests SBOMs, in-toto/SLSA attestations, Sigstore records and VEX feeds, correlates them in Neo4j and answers blast‑radius questions like “If TravisCI is compromised which software is affected.” It finds surprising transitive dependencies (examples: libpcre and sed), demonstrates 8,000 nodes from ~70 documents, highlights problems with spec noncompliance and mixed identifiers/hashes, and exposes unfixed Log4J paths. Roadmap includes a public query service, GraphQL APIs, local instances and editor/package‑manager plugins to automate policy checks.
AI-written summary · about
chapters (6)
- 0:00Start
- 1:11The Problem
- 4:34How Does it Work?
- 5:13What does this look like
- 17:24Challenges
- 20:54Next Steps
related talks
40mFresh SLSA and GUAC Starts with Knowing Your Ingredients
40mWhere Is the GUAC?
37mEliminating the Unknowns: Using GUAC to Better Understand Your Software Supply...
36mA Mouthful of Mayhem: Taste Test and Gut Response to SLSA, GUAC, and Supply Chain’...
24mYour company, as a Knowledge Graph - the foundation of cybersecurity’s future
10mCharting the Course for Secure Software Supply Chain with Guac-AI-Mole!
27mHow Trustworthy is Your Knowledge Graph?
28mProduction, Consumption, and the Data: The Open Source Security Sandwich