## Metadata: - Source: Google Online Security Blog (Brandon Lum, Mihai Maruseac, Isaac Hepworth — Google Open Source Security Team) - Reference: https://security.googleblog.com/2022/10/announcing-guac-great-pairing-with-slsa.html [[3. Resources/Readwise/Articles/Announcing GUAC, a great pairing with SLSA (and SBOM)!|Announcing GUAC, a great pairing with SLSA (and SBOM)!]] ## Summary: Google introduced **GUAC** (Graph for Understanding Artifact Composition), an open-source project that aggregates and synthesizes scattered software-security metadata (SBOMs, SLSA attestations, vuln feeds, etc.) into one queryable graph. The aim is to *democratize* supply-chain security — making a comprehensive view of an organization's software assets freely available, not just to those with large security budgets. Built with Kusari, Purdue University, and Citi. ## Main Content: - **The problem:** supply-chain security metadata is real but scattered across many databases and producers, so no one can easily get a unified view of what they actually ship (Log4j-style exposure is hard to assess). - **What GUAC does:** normalizes entity identities and maps standard relationships across sources, then lets you *query* the combined graph. - **Four functional areas:** collection, ingestion, collation, and query. - **Outcomes it enables:** audit, policy compliance, risk management, and developer assistance. - *Proactive:* assess supply-chain risk, identify critical components, prevent compromise. - *Operational:* verify that production binaries trace back to securely managed repositories. - *Reactive:* pinpoint affected inventory when a new vuln or deprecated dependency appears. - **Posture:** open-source on GitHub, contributions welcome; GUAC *pairs* with SLSA (provenance) and SBOM (inventory) rather than replacing them. ## Links - [[Open Source Governance MOC]] — applies-in — tooling that makes open-source dependency risk governable - [[WordPress Hosting Security Stack MOC]] — applies-in — supply-chain visibility as a layer of the security stack - [[A Field Guide to Threat Vectors in the Software Supply Chain]] — evidence-for — GUAC operationalizes the dependency/build-pipeline threats that note names (reciprocal link) - [[3. Resources/Literature Notes/What's in Your AI — The Case for AI Bills of Materials (Alan Friedman, RSAC)]] — because contrasts: GUAC is the inventory-to-risk-data mapping layer for software, and Friedman's talk is largely an argument that AI has no equivalent yet.