GUAC Beta v0.1 provides a runnable service for users to get started with building a software catalog and understanding their organization's software supply chain and prototyping security evaluations and controls.
With the GUAC Beta, a user can provide their SBOM and SLSA documents and the service will ingest the software metadata into a knowledge graph which will automatically be augmented with additional vulnerability, security and open source insights (e.g. OSV.dev, Deps.dev, Scorecards). All this information will then be accessible and queryable to answer supply chain questions.
With the help of additional experimental utilities, a user will be able to:
Understand the "hidden" imported dependencies and the scale of the organization's software supply chain blast radius
Finding out if my organization's software is vulnerable to log4shell
Marking certain software as "known bad" (e.g. known malware, compromise) and detect if software uses it
The above examples showcase some utilities we've built to preview the GUAC Beta API. As a developer, you can leverage this yourself and build your own products on GUAC through our GraphQL API. For example, you may be able to create a:
Code IDE plugins that enforces supply chain security policy at development time
Note:
The GUAC Beta is NOT production ready. We'd like to get feedback on both the capabilities of the service and use cases from an end-user perspective as well as the GraphQL API from a developer perspective.
What does it include
Provide a deployable service that an organization will be able to answer the vulnerability question (and more) about their software dependencies.
E2E Service with an experimental web interface for users to query by software identifiers
GUAC consumes/ingests organization SBOMs and SLSA documents
GUAC augments the graph automatically with Open Source Insights and security metadata (deps.dev, osv.dev, scorecards)
A set of example utilities building on top of the GraphQL interface to showcase building on top of GUAC
Below this line are logistics/planning
Example flow
Setting up and configuring GUAC through an all-in-one container
The GUAC Web UI
The GUAC results page with insights and navigable graph
Technical Details
This should include:
Ability for parsers to request the augmentation of additional data in GUAC (functional equivalence to "Fetcher" component in initial design doc)
Implement golang genqlient and gqlgen into GUAC project
Generate a GraphQL interface that would ensure that the proof of concept from SETUP.md and the certifier workflow produce the same results via Cypher and via the new interface. This phase involves building the GraphQL interface for read only queries from the database.
tracking all the queries that are currently being used to write to the database and creating corresponding GraphQL mutations.
GUAC Beta v0.1
GUAC Beta v0.1 provides a runnable service for users to get started with building a software catalog and understanding their organization's software supply chain and prototyping security evaluations and controls.
With the GUAC Beta, a user can provide their SBOM and SLSA documents and the service will ingest the software metadata into a knowledge graph which will automatically be augmented with additional vulnerability, security and open source insights (e.g. OSV.dev, Deps.dev, Scorecards). All this information will then be accessible and queryable to answer supply chain questions.
With the help of additional experimental utilities, a user will be able to:
The above examples showcase some utilities we've built to preview the GUAC Beta API. As a developer, you can leverage this yourself and build your own products on GUAC through our GraphQL API. For example, you may be able to create a:
Note: The GUAC Beta is NOT production ready. We'd like to get feedback on both the capabilities of the service and use cases from an end-user perspective as well as the GraphQL API from a developer perspective.
What does it include
Provide a deployable service that an organization will be able to answer the vulnerability question (and more) about their software dependencies.
Below this line are logistics/planning
Example flow
Setting up and configuring GUAC through an all-in-one container
The GUAC Web UI
The GUAC results page with insights and navigable graph
Technical Details
This should include:
genqlient
andgqlgen
into GUAC projectSETUP.md
to use this modelTechnical issues that need to be ironed out:
Performance issues that need to track: