Eliminating the Unknowns: Using GUAC to Better Understand Your Software Supply...
summary
GUac ingests and correlates real SBOMs and attestations (CycloneDX and SPDX SBOMs, in-toto SLSA attestations signed by Sigstore), pulls OSV, VEX, salsa provenance, and deps data, and resolves identities and cross-format identifiers into a knowledge graph. It accepts files from OCI registries, S3/GCS, Git/GitHub, exposes a GraphQL API, CLI, VS Code plugin and visualizer, and runs patch‑planning queries (demo: traced a curl CVE across Debian and Alpine packages to list affected dependents). Roadmap adds signature/trust tracking and policy engine integrations. CycloneDX and SPDX SBOMs in-toto SLSA attestations signed by Sigstore OSV and VEX data GraphQL API with VS Code plugin
AI-written summary · about
chapters (8)
- 0:00GUAC and supply chain security
- 3:39Software supply chains
- 9:22What GUAC is
- 14:00GUAC architecture
- 21:29Demo: curl vulnerability
- 27:06GUAC features
- 28:08GUAC roadmap
- 29:33Q&A
related talks
40mWhere Is the GUAC?
36mA Mouthful of Mayhem: Taste Test and Gut Response to SLSA, GUAC, and Supply Chain’...
10mCharting the Course for Secure Software Supply Chain with Guac-AI-Mole!
34mIt's Dangerous To SLSA Alone Out There! Take This Artifact Knowledge Graph!
44mImproving the Software Supply Chain Security
33mMind the Gap: Bridging Supply Chain Policy With Git-less GitOps and GUAC
40mFresh SLSA and GUAC Starts with Knowing Your Ingredients
36mSBOMs, VEX, and Kubernetes