Where Is the GUAC?
summary
GUAC ingests SBOMs and attestations (SPDX, CycloneDX, SALSA) from local folders or OCI into a knowledge graph and exposes it via GraphQL query layer and visualizer so users can ask concrete questions like “which images include log4j” or “which packages transitively expose CVE‑IDs from OSV.” The demo runs as modular services (ingesters, deps.dev and OSV collectors, certifier) with Docker Compose/Helm; it currently uses an in‑memory DB but persists links and ingests SBOMs and attestations into a graph DB and resolves vulnerabilities, counterfactuals, and certified‑bad blast radii.
AI-written summary · about
chapters (24)
- 0:00GUAC and supply chain security
- 1:06Complex dependency chains and SBOMs
- 2:08GUAC as knowledge graph
- 4:16Setting up GUAC and demo
- 7:04Ingesting SBOMs and attestations
- 8:47Dynamic updates and vulnerability checks
- 11:33Automatic integrations in GUAC
- 12:39Querying vulnerabilities and paths
- 13:43Visualizing supply chain risks
- 15:49Remediating vulnerabilities with GUAC
- 16:52Handling SALSA attestations
- 18:59Certifying bad packages
- 20:49Querying bad components
- 22:49Shifting left with GUAC
- 23:31GUAC architecture overview
- 25:55GraphQL for queries and integrations
- 27:23GUAC roadmap and future
- 30:11Community resources and contributions
- 31:17Package references and gaps
- 33:45Identity and conflict resolution
- 35:09How to help GUAC grow
- 36:10Handling conflicting documents
- 37:53Comparing SBOMs and differences
- 39:01Q&A
related talks
37mEliminating the Unknowns: Using GUAC to Better Understand Your Software Supply...
36mA Mouthful of Mayhem: Taste Test and Gut Response to SLSA, GUAC, and Supply Chain’...
34mIt's Dangerous To SLSA Alone Out There! Take This Artifact Knowledge Graph!
10mCharting the Course for Secure Software Supply Chain with Guac-AI-Mole!
29mWhy Don’t We Have Both? Track Build- and Run-time Information for Security With Kubescape and GUAC
40mFresh SLSA and GUAC Starts with Knowing Your Ingredients
33mMind the Gap: Bridging Supply Chain Policy With Git-less GitOps and GUAC
28mProduction, Consumption, and the Data: The Open Source Security Sandwich