Where Is the GUAC? - Parth Patel, Kusari & Mihai Maruseac, Google
Channel: The Linux Foundation
Date: 2023-05-25

Where Is the GUAC? - Parth Patel, Kusari & Mihai Maruseac, Google

Understanding the state of a software environment is now more important than ever. With malicious packages and typo-squatting attacks on the rise, users and organizations need a better understanding of their software ecosystem. By integrating metadata about software projects, artifacts, and attestations, Graph for Understanding Artifact Composition (GUAC) offers a comprehensive view of the state of the supply chain. GUAC ingests SBOMs and other attestations from various sources (such as a local folder or from OCI directly) into a graph database abstracted via GraphQL. By utilizing GUAC, organizations can quickly answer questions such as “Is my project vulnerable to the log4shell vulnerability?” and “If I am vulnerable, what packages in my ecosystem need to be updated?” By taking into account both the attestations and the identity information, GUAC can also identify counterfactuals and allow answering these queries under different trust policies. By integrating OSV, deps.dev, and Scorecards, GUAC can continually enrich the graph with critical missing information to allow the user to get a complete overview of their software supply chain. This vast dataset combined with GraphQL will also allow automated policies to determine if an artifact is authorized to run in production.