Google Launches GUAC Open Source Project to Secure Software Supply Chain
Google on Thursday announced that it’s seeking contributors to a new open source initiative called Graph for Understanding Artifact Composition, also known as GUAC, as part of its ongoing efforts to beef up the software supply chain.
“GUAC addresses a need created by the burgeoning efforts across the ecosystem to generate software build, security, and dependency metadata,” Brandon Lum, Mihai Maruseac, and Isaac Hepworth of Google said in a post shared with The Hacker News.
“GUAC is meant to democratize the availability of this security information by making it freely accessible and useful for every organization, not just those with enterprise-scale security and IT funding.”
Software supply chain has emerged a lucrative attack vector for threat actors, wherein exploiting just one weakness — as seen in the case of SolarWinds and Log4Shell — opens a pathway long enough to traverse down the supply chain and steal sensitive data, plant malware, and take control of systems belonging to downstream customers.
Google, last year, released a framework called SLSA (short for Supply chain Levels for Software Artifacts) that aims to ensure the integrity of software packages and prevent unauthorized modifications.
It has also launched an updated version of Security Scorecards, which identifies the risk third-party dependencies can introduce to a project, allowing developers to make informed decisions about accepting vulnerable code or considering other alternatives.
This past August, Google further introduced a bug bounty program to identify security vulnerabilities spanning a number of projects such as Angular, Bazel, Golang, Protocol Buffers, and Fuchsia.
GUAC is the company’s latest effort to bolster the health of the supply chain. It achieves this by aggregating software security metadata from a mix of public and private sources into a “knowledge graph” that can answer questions about supply chain risks.
The data that undergirds this architecture is derived from Sigstore, GitHub, Open Source Vulnerabilities (OSV), Grype, and Trivy, among others, to derive meaningful relationships between vulnerabilities, projects, resources, developers, artifacts, and repositories.
“Querying this graph can drive higher-level organizational outcomes such as audit, policy, risk management, and even developer assistance,” Google said.
Put differently, the idea is to connect the different dots between a project and its developer, a vulnerability and the corresponding software version, and the artifact and the source repository it belongs to.
The aim, therefore, is to not only enable organizations to determine if they are affected by a specific vulnerability, but also estimate the blast radius should the supply chain be compromised.
That said, Google also appears to be cognizant of the potential threats that could undermine GUAC, including scenarios where the system is tricked into ingesting forged information about artifacts and their metadata, which it expects to mitigate through cryptographic verification of data documents.
“[GUAC] aims to satisfy the use case of being a monitor for public supply chain and security documents as well as for internal use by organizations to query information about artifacts that they use,” the internet giant noted.