Name
CNCF Supply Chain Security Insights
Short description
Develop infrastructure and processes to aggregate and analyze software supply chain metadata (SBOMs, attestations, vulnerabilities) from CNCF projects, providing a unified, queryable view.
Responsible group
TAG Security and Compliance
Does the initiative belong to a subproject?
No
Subproject name
No response
Primary contact
Matt Young
Additional contacts
No response
Initiative description
CNCF Supply Chain Security Insights
Description
Develop infrastructure and processes to aggregate and analyze software supply chain metadata (SBOMs, attestations, vulnerabilities) from CNCF projects, providing a unified, queryable view.
Relevant TAGs/WGs
TAG Security, TAG Contributor Strategy (re: project metadata), potentially TAG App Delivery, TAG Operational Resilience
Problem Statement
Understanding the collective software supply chain composition (dependencies, known vulnerabilities, attestations) across the CNCF project ecosystem is difficult. Metadata exists but is often fragmented, lacking aggregation and analysis capabilities needed for ecosystem-wide insights.
Scope
In Scope
- Identify sources and methods for collecting software supply chain metadata (e.g., SBOMs, VEX documents, build attestations) from CNCF projects
- Establish data pipelines to ingest and normalize this metadata
- Implement or leverage a central data store (e.g., a graph database like GUAC, or other suitable system) capable of representing supply chain relationships
- Develop methods and example queries to analyze the aggregated data for security posture, dependency tracking, and compliance insights across the ecosystem
- Document the architecture and processes
Out of Scope
- Real-time alerting
- Enforcement of supply chain policies
- Analysis beyond the scope of CNCF projects initially
Goals
- Establish a repeatable process for collecting available supply chain metadata from a significant subset of CNCF projects
- Deploy and populate a data store with aggregated, normalized supply chain information
- Provide documented examples of queries or analyses that yield valuable insights into the CNCF ecosystem's supply chain (e.g., prevalence of specific vulnerable dependencies, SBOM availability trends)
- Create a foundation for potential future supply chain security initiatives within the CNCF
Non-Goals
- Replacing project-specific security tools or processes
- Guaranteeing the completeness or absolute accuracy of all metadata (as it depends on source availability and quality)
- Building a user-facing dashboard within the initial phase
Implementation Plan
Establish data pipelines to process SBOMs and other artifacts. Create a hosted GUAC instance on CNCF infrastructure providing:
- SBOMs and other artifacts for all CNCF projects are metadata
- Interactive visualization of transitive dependencies and vulnerabilities for the CNCF project ecosystem
- Clear view of our collective CNCF constellation, and the rest of the known open source universe. Let's fly around it!
- Manageable via self serve workflows (PR's to .yaml config, like landscape) and badges.
GUAC (Graph for Understanding Artifact Composition)
GUAC is an OpenSSF project, under the Supply Chain Integrity WG.
"Graph for Understanding Artifact Composition (GUAC) gives you organized and actionable insights into your software supply chain security position. GUAC ingests software security metadata, like SBOMs, and maps out the relationship between software so that you can fully understand your software security position. Using GUAC, you can drive higher-level organizational outcomes such as audit, policy, risk management, and even developer assistance." (https://docs.guac.sh)
A more technical description (from https://github.com/guacsec/guac):
Graph for Understanding Artifact Composition (GUAC) aggregates software security metadata into a high fidelity graph database—normalizing entity identities and mapping standard relationships between them. Querying this graph can drive higher-level organizational outcomes such as audit, policy, risk management, and even developer assistance. Conceptually, GUAC occupies the "aggregation and synthesis" layer of the software supply chain transparency logical model:
(diagrams taken from KubeCon EU 2025 talk "Why Don’t We Have Both? Track Build- and Run-time Information for Security With Kubescape and GUAC" by Jeff Mendoza, Kusari & Ben Hirschberg, ARMO (https://youtu.be/x5qguW0SF_I?si=-A94y25oqyntiXa5)
Resource Requirements
- Expertise in software supply chain security concepts, metadata formats (SBOMs, etc.), data engineering, and potentially graph databases or specific tools like GUAC
- Compute and storage resources for data processing and storage
- Access to CNCF project artifact sources/APIs
- Collaboration time with TAG Security and OpenSSF project (guac.sh
Timeline
Estimate: 6-9 months for establishing initial data aggregation and analysis capabilities.
Current Date: May 11, 2025
Additional References
- GUAC Official Website - Main site for the Graph for Understanding Artifact Composition
- OpenSSF Tech Talk: Proactive Supply Chain Security with GUAC - Technical overview of GUAC capabilities
- Eliminating the Unknowns: Using GUAC to Better Understand Your Software Supply Chain - Presentation by Michael Lieberman
- Kusari's Michael Lieberman Talks GUAC, SLSA and Securing the Open Source Supply Chain - Interview on supply chain security
- SPDX Specification - Standard for Software Bill of Materials
- CycloneDX Specification - Alternative SBOM standard
- VEX (Vulnerability Exploitability eXchange) - CISA's guidelines for vulnerability information
Deliverable(s) or exit criteria
- Successful aggregation of supply chain metadata from a defined set of CNCF projects into the GUAC and/or other data stores.
- Demonstrated ability to query the aggregated data to answer meaningful questions about the CNCF supply chain
- Architecture, data sources, and analysis methods are documented
Name
CNCF Supply Chain Security Insights
Short description
Develop infrastructure and processes to aggregate and analyze software supply chain metadata (SBOMs, attestations, vulnerabilities) from CNCF projects, providing a unified, queryable view.
Responsible group
TAG Security and Compliance
Does the initiative belong to a subproject?
No
Subproject name
No response
Primary contact
Matt Young
Additional contacts
No response
Initiative description
CNCF Supply Chain Security Insights
Description
Develop infrastructure and processes to aggregate and analyze software supply chain metadata (SBOMs, attestations, vulnerabilities) from CNCF projects, providing a unified, queryable view.
Relevant TAGs/WGs
TAG Security, TAG Contributor Strategy (re: project metadata), potentially TAG App Delivery, TAG Operational Resilience
Problem Statement
Understanding the collective software supply chain composition (dependencies, known vulnerabilities, attestations) across the CNCF project ecosystem is difficult. Metadata exists but is often fragmented, lacking aggregation and analysis capabilities needed for ecosystem-wide insights.
Scope
In Scope
Out of Scope
Goals
Non-Goals
Implementation Plan
Establish data pipelines to process SBOMs and other artifacts. Create a hosted GUAC instance on CNCF infrastructure providing:
GUAC (Graph for Understanding Artifact Composition)
GUAC is an OpenSSF project, under the Supply Chain Integrity WG.
"Graph for Understanding Artifact Composition (GUAC) gives you organized and actionable insights into your software supply chain security position. GUAC ingests software security metadata, like SBOMs, and maps out the relationship between software so that you can fully understand your software security position. Using GUAC, you can drive higher-level organizational outcomes such as audit, policy, risk management, and even developer assistance." (https://docs.guac.sh)
A more technical description (from https://github.com/guacsec/guac):
Graph for Understanding Artifact Composition (GUAC) aggregates software security metadata into a high fidelity graph database—normalizing entity identities and mapping standard relationships between them. Querying this graph can drive higher-level organizational outcomes such as audit, policy, risk management, and even developer assistance. Conceptually, GUAC occupies the "aggregation and synthesis" layer of the software supply chain transparency logical model:
(diagrams taken from KubeCon EU 2025 talk "Why Don’t We Have Both? Track Build- and Run-time Information for Security With Kubescape and GUAC" by Jeff Mendoza, Kusari & Ben Hirschberg, ARMO (https://youtu.be/x5qguW0SF_I?si=-A94y25oqyntiXa5)
Resource Requirements
Timeline
Estimate: 6-9 months for establishing initial data aggregation and analysis capabilities.
Current Date: May 11, 2025
Additional References
Deliverable(s) or exit criteria