# GUAC | Aggregates Software Security Metadata Into A High Fidelity Graph Database

**URL:** <https://onehack.st/t/guac-aggregates-software-security-metadata-into-a-high-fidelity-graph-database/232075>\
**Category:** Tools & Scripts\
**Tags:** tools, programming\
**Created:** [January 27, 2023, 6:13pm UTC](https://onehack.st/t/guac-aggregates-software-security-metadata-into-a-high-fidelity-graph-database/232075 "2023-01-27T18:13:48Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\
**Post date:** [January 27, 2023, 6:13pm UTC](https://onehack.st/t/guac-aggregates-software-security-metadata-into-a-high-fidelity-graph-database/232075/1 "2023-01-27T18:13:48Z")

</div>

[![](https://user-images.githubusercontent.com/3060102/204297133-9bf702c6-b4e2-46df-a029-42b5060b19a4.png)](https://user-images.githubusercontent.com/3060102/204297133-9bf702c6-b4e2-46df-a029-42b5060b19a4.png)

**Note:** GUAC is under active development - if you are interested in contributing, please look at [contributor guide](https://github.com/guacsec/guac/blob/main/CONTRIBUTING.md) and the [“express interest” issue](https://github.com/guacsec/guac/issues/1)

Graph for Understanding Artifact Composition (GUAC) aggregates software security metadata into a high fidelity graph database—normalizing entity identities and mapping standard relationships between them. Querying this graph can drive higher-level organizational outcomes such as audit, policy, risk management, and even developer assistance.

Conceptually, GUAC occupies the “aggregation and synthesis” layer of the software supply chain transparency logical model:

[![image](https://user-images.githubusercontent.com/3060102/196563695-a1cdc8bd-9946-482f-873a-937bf75891dc.png)](https://user-images.githubusercontent.com/3060102/196563695-a1cdc8bd-9946-482f-873a-937bf75891dc.png)

A few examples of questions answered by GUAC include:

[![image](https://user-images.githubusercontent.com/3060102/182689788-70acefc1-6d69-4972-abbf-3e60c0d4c014.png)](https://user-images.githubusercontent.com/3060102/182689788-70acefc1-6d69-4972-abbf-3e60c0d4c014.png)

## Quickstart

Refer to the [Setup + Demo](https://github.com/guacsec/guac/blob/main/SETUP.md) document to learn how to prepare your environment and try GUAC out!

## Architecture

Here is an overview of the architecture of GUAC:

[![image](https://user-images.githubusercontent.com/3060102/182689908-477f4770-1142-4c18-8fa9-16d93dcf84b4.png)](https://user-images.githubusercontent.com/3060102/182689908-477f4770-1142-4c18-8fa9-16d93dcf84b4.png)

## Supported input formats

- [CycloneDX](https://github.com/CycloneDX/specification)
- [Dead Simple Signing Envelope](https://github.com/secure-systems-lab/dsse)
- [In-toto ITE6](https://github.com/in-toto/attestation)
- [OpenSSF Scorecard](https://github.com/ossf/scorecard)
- [SLSA](https://github.com/slsa-framework/slsa)
- [SPDX](https://spdx.dev/specifications/)

## Additional References

- [GUAC Intro Slides](https://docs.google.com/presentation/d/1WF4dsJiwR6URWPgn1aiHAE3iLVl-oGP4SJRWFpcOlao/edit#slide=id.p)
- [GUAC Design Doc](https://docs.google.com/document/d/1N5x0HErb-kmCPgG9M8TwBEOGIVU54clqp_X4KhtNJI8/edit)

## Communication

We encourage discussions to be done on github issues. We also have a [public slack channel](https://openssf.slack.com/archives/C03U677QD46) on the OpenSSF slack.

For security issues or code of conduct concerns, an e-mail should be sent to [guac-maintainers@googlegroups.com](mailto:guac-maintainers@googlegroups.com).

## Governance

Information about governance can be found [here](https://github.com/guacsec/guac/blob/main/GOVERNANCE.md).

## GitHub:

[https://github.com/guacsec/guac](https://github.com/guacsec/guac)