GUAC+Trustify - Building a Common Supply Chain Knowledge Graph

Explore how two major open source supply chain security projects are joining forces in this 15-minute conference talk from OpenSSF. Learn about the strategic merger of GUAC and Trustify under a unified umbrella to tackle the complex challenges of consuming, processing, and utilizing supply chain security metadata at scale. Discover the grand vision for creating a central hub within OpenSSF that focuses on building and using supply chain knowledge graphs, including defining common standards, data models, and ontologies, developing shared infrastructure and libraries, and improving the overall tooling ecosystem. Understand the specific challenges each project faced while working independently and how their collaboration will enhance supply chain visibility and security for the entire open source community. Gain insights into the community-driven approach that aims to foster collaboration, knowledge sharing, and provide a welcoming environment for contributors working on supply chain security initiatives.