GUAC 1.0 Is Now Available  ## Metadata - Author: [[OpenSSF]] - Full Title: GUAC 1.0 Is Now Available - Category: #articles - Document Note: --- tags: - #open-source - #software-supply-chain - #sbom - #security - #guac - #opensourcecommunity - #devrel - #sustainability - #transparency - #deib Author: Parth Patel, Brandon Lum, Santiago Torres-Arias Source: OpenSSF / Readwise Reference: [GUAC 1.0 is Now Available | Readwise](https://read.readwise.io/new/read/01jxjv8nt4xbn95r25gj6pzep7) date created: 2025-06-12 18:47 --- # Title: GUAC 1.0 is Now Available ## Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📖 References](#-references) - [🗣️ Paraphrase](#-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB (Diversity, Equity, Inclusion, and Belonging) Assessment](#-deib-diversity-equity-inclusion-and-belonging-assessment) - [✅ Logical validity](#-logical-validity) - [🔍 DARVO Analysis Prompt](#-darvo-analysis-prompt) - [🔍 SEO Evaluation](#-seo-evaluation) - [🎯 Conclusion](#-conclusion) --- ## 📝 Summary GUAC 1.0, the first stable release of the Graph for Understanding Artifact Composition, marks a significant milestone in open source software supply chain security. Developed by Kusari, Google, and Purdue University, and supported by a broad community, GUAC aggregates and enriches SBOMs (Software Bill of Materials) to provide a comprehensive, actionable view of software dependencies, vulnerabilities, and metadata. This release addresses the growing complexity and regulatory demands of managing SBOMs, offering extensible tools for organizations to better understand and secure their software ecosystems. --- ## 📖 Main Content GUAC 1.0 emerges as a response to the overwhelming proliferation of SBOMs in modern software development. While SBOMs are now a regulatory and procurement necessity, their sheer volume and limited scope (often missing transitive dependencies and real vulnerability context) have left organizations struggling to translate them into meaningful security improvements. GUAC tackles this by: - Aggregating SBOMs from diverse sources (file systems, object storage, image/code repositories). - Parsing them into a graph database, enabling rich queries about relationships between packages, binaries, and images. - Enriching this graph with vulnerability data, license info, end-of-life status, OpenSSF Scorecard scores, and more. - Providing extensibility for custom data sources and queries, empowering organizations to tailor insights to their unique needs. A standout feature is GUAC’s “patch plan,” which helps teams strategize vulnerability remediation across dependency “frontiers”—from direct packages to higher-level components. The graph API further enables custom analysis, such as license compliance checks. Looking ahead, GUAC’s importance will only grow as regulations like the EU’s Cyber Resilience Act and major customer requirements demand not just SBOM generation, but deep, actionable understanding of the software supply chain. The project invites community participation to shape its future. ### 🗒️ Notes - **GUAC 1.0 Release** - First stable release of the Graph for Understanding Artifact Composition. - Backed by Kusari, Google, Purdue University, and over 400 contributors from 90+ organizations. - Focuses on software supply chain security and SBOM management. - **SBOM Challenges** - Regulatory and purchasing pressures have increased SBOM production. - Organizations are overwhelmed by the volume and retention requirements. - SBOMs often lack transitive dependencies and real vulnerability context. - Security posture hasn’t improved just by producing more SBOMs. - **GUAC’s Solution** - Aggregates SBOMs from multiple sources. - Parses SBOMs into a graph database for relationship analysis. - Enriches data with vulnerabilities, licenses, dependencies, end-of-life info, and more. - Extensible for custom data sources and queries. - **Key Features** - Patch plan: Maps out remediation strategies across dependency frontiers. - Graph API: Enables custom queries (e.g., license compliance). - Supports actionable insights for real-world security questions. - **Future Outlook** - Regulatory demands (e.g., EU Cyber Resilience Act) will increase need for tools like GUAC. - Community involvement is encouraged for ongoing development. - **About the Authors** - Parth Patel: Co-founder at Kusari, open source leader. - Brandon Lum: Google, security systems expert, open source maintainer. - Santiago Torres-Arias: Purdue University, secure systems researcher. --- ## 📖 References - [GUAC 1.0 is Now Available | Readwise](https://read.readwise.io/new/read/01jxjv8nt4xbn95r25gj6pzep7) - OpenSSF Blog - GUAC Project Documentation --- ## 🗣️ Paraphrase 1. **Original:** “While organizations have started producing more SBOMs (and requiring SBOMs from their suppliers), they’ve found that their overall security posture hasn’t changed. SBOMs don’t always contain transitive dependencies, they don’t tell the organization what vulnerabilities exist (and which ones aren’t actually an issue), and they look at a single application at a single point in time. SBOMs are a solid foundation for understanding an organization’s software supply chain, but they’re not enough on their own.” **Paraphrased:** Even as companies ramp up SBOM creation and demand them from partners, they’re realizing this alone doesn’t make them safer. SBOMs often miss indirect dependencies, fail to clarify which vulnerabilities matter, and only provide a snapshot of one app at one moment. They’re a good starting point for supply chain visibility, but insufficient by themselves. 2. **Original:** “GUAC’s value comes from its ability to aggregate and enrich SBOMs to give a fuller view across the entire application portfolio. GUAC collects and stores SBOMs from file systems, object storage, image repositories, and code repositories. After ingesting the SBOM, GUAC parses it into a graph database, which allows the user to evaluate relationships between software packages, binaries, and container images.” **Paraphrased:** GUAC stands out by pulling - Summary: The GUAC project is proud to announce the release of GUAC 1. 0. - URL: https://openssf.org/blog/2025/06/12/guac-1-0-is-now-available/ 📣 Submit your proposal: **OpenSSF Community Day [Korea](https://events.linuxfoundation.org/openssf-community-day-korea/program/cfp/?__hstc=14087400.2303a37263f4b6c71fb2e86200bd66fe.1749758003776.1749758003776.1749758003776.1&__hssc=14087400.1.1749758003776&__hsfp=1908568885) | [Open Source SecurityCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/co-located-events/cfp-colocated-events/?__hstc=14087400.2303a37263f4b6c71fb2e86200bd66fe.1749758003776.1749758003776.1749758003776.1&__hssc=14087400.1.1749758003776&__hsfp=1908568885)**  By Parth Patel (Kusari), Brandon Lum (Google), Santiago Torres-Arias (Purdue University) The GUAC project is proud to announce the release of GUAC 1.0. GUAC — which stands for “Graph for Understanding Artifact Composition” is an OpenSSF incubating project that brings understanding and insights to the software supply chain. Started by Kusari, Google, and Purdue University, GUAC has contributions from over 400 people representing more than 90 organizations including Microsoft and Red Hat. GUAC 1.0 brings stability to the core functionality, along with additional features still in an experimental state. See the [GUAC blog post](https://guac.sh/blog/2025-06-12-guac-v1.0/) for details. #### Taming the SBOM monster Regulatory and purchasing pressure has driven the industry to put more emphasis on creating software bills of materials (SBOMs) — a standardized listing of the components that go into a piece of software. But with each new release — or each build of an internal application — comes a new SBOM. With tens or hundreds of microservices, even a mid-sized organization can quickly be overwhelmed with SBOMs. When you add in retention requirements, the scale balloons quickly. We have created an SBOM monster. While organizations have started producing more SBOMs (and requiring SBOMs from their suppliers), they’ve found that their overall security posture hasn’t changed. SBOMs don’t always contain transitive dependencies, they don’t tell the organization what vulnerabilities exist (and which ones aren’t actually an issue), and they look at a single application at a single point in time. SBOMs are a solid foundation for understanding an organization’s software supply chain, but they’re not enough on their own. #### Dipping into GUAC GUAC’s value comes from its ability to aggregate and enrich SBOMs to give a fuller view across the entire application portfolio. GUAC collects and stores SBOMs from file systems, object storage, image repositories, and code repositories. After ingesting the SBOM, GUAC parses it into a graph database, which allows the user to evaluate relationships between software packages, binaries, and container images. GUAC also enriches the graph by querying trusted services for additional information about packages. It adds vulnerability data, licenses, additional dependencies, end-of-life information, [OpenSSF Scorecard](https://scorecard.dev/) scores, and more. GUAC is designed to be easily extensible, so users can add new sources of information relevant to their needs. With an enriched view of a team or organization’s entire ecosystem, it becomes possible to answer real-world questions. For example: “how do I patch a newly-announced vulnerability?” GUAC’s patch plan feature shows how to address a vulnerability across “frontiers.” These frontiers represent what can be patched to resolve the vulnerability, starting from the lowest level possible, i.e. the package itself. If you don’t have access to fix this package directly, you could look in the next frontier and so on. Using the graph API, users can write custom queries for questions that aren’t supported out of the box. For example, Ben Cotton wrote a [short Python script](https://github.com/guacsec/guac-data/blob/main/scripts/license_check/license_check.py) that checks for differences between the declared and detected licenses in software packages in the graph. This ability to ask questions about the supply chain and take quick action to resolve issues. #### Looking forward The problem will only continue to grow. Regulations like Europe’s Cyber Resilience Act (CRA) and customer requirements like Citi’s [Requirements for Suppliers](https://www.citigroup.com/rcs/citigpa/storage/public/Citi-Requirements-for-Suppliers-English.pdf) will place more demands on organizations to not only produce SBOMs, but to have a fuller understanding of their software supply chain. This makes tools like GUAC all the more important. The GUAC community isn’t stopping with the 1.0 release. If you are interested in better managing your SBOMs and software supply chain metadata, come [join our community](https://guac.sh/community). ##### About the Authors Parth Patel is co-founder and Chief Product Officer at Kusari, where he focuses on bringing transparency and security to the forefront of all projects. He is an engineering leader with more than 15 years of cybersecurity, DevOps, software development, and automation experience. Parth is an active member within the open-source community, serving as a co-creator and lead maintainer on the GUAC project, and a maintainer for the CNCF in-toto attestations, CNCF in-toto golang, and FRSCA projects. Brandon Lum is a seasoned technologist with a passion for designing and implementing security systems. His experience spans cutting-edge research at IBM Research, where he focused on zero trust workload identity, kernel attack surface reduction, and image encryption/signing, to security hardening and offensive security at KPMG and as part of the PPP CTF team. At Google, he is a lead of the Software Supply Chain Integrity (SSCI) observability initiative, where he spearheads the aggregation and synthesis of Google’s extensive software supply chain metadata, including SBOM, SLSA, and VEX, at scale. Beyond Google, Brandon is an influential figure in the open-source and security standards communities. He serves as Co-chair Emeritus of the CNCF Security TAG and maintains key security projects like SPDX, OpenVEX, GUAC, and SPIFFE/SPIRE. Santiago Torres-Arias is an assistant professor at Purdue University, where researches secure systems, applied cryptography and software supply chain security. Santiago is the team lead of in-toto, a framework to secure the SDLC, as well as PolyPasswordHasher, a password storage mechanism, and is a GUAC maintainer., GUAC 1.0 Is Now Available, OpenSSF, 01jxjv8nt4xbn95r25gj6pzep7.