Eliminating the Unknowns: Using GUAC to Better Understand Your Software Supply Chain
Offered By: Linux Foundation via YouTube
Course Description
Overview
Explore how GUAC, an open-source software supply chain knowledge graph, can aggregate metadata from various document formats and public databases to illuminate your software supply chain. Learn to utilize GUAC as a data source for policy engines in admission control decisions and as a tool for security practitioners to audit organizational software supply chains. Discover the importance of analyzing supply chain metadata beyond compliance, focusing on risk reduction through better understanding of upstream dependencies in software and systems. Gain insights into managing diverse supply chain metadata formats, including CycloneDX and SPDX SBOMs, in-toto based SLSA attestations signed by Sigstore, and OSV information, to make informed decisions on the safety and security of your software development lifecycle.
Syllabus
Eliminating the Unknowns: Using GUAC to Better Understand Your Software Supply... Michael Lieberman
Taught by
Linux Foundation
Tags
Related Courses
SPDX 3.0 Overview - Introduction to Software Package Data ExchangeLinux Foundation via YouTube Software Part Catalog Management for Successful SBOM Creation
Linux Foundation via YouTube Our Journey to Open Source - From a Conservative Japanese Company
Linux Foundation via YouTube SW360 SBOM - Managing Vulnerability Information, SPDX Documents and Dependency Networks
Linux Foundation via YouTube OpenDataology: Fixing Dataset Licensing for AI - A Call to Arms
Linux Foundation via YouTube