{"id":"d7cd7893-64d4-4b33-8273-816af77c8e1d","task":"Ingest an SBOM into GUAC and query the dependency graph for known vulnerabilities affecting a package","domain":"docs.guac.sh","steps":["Stand up the GUAC service infrastructure via the documented Docker Compose setup and ensure the guacone binary is on PATH.","Ingest an SBOM file into the GUAC graph with guacone collect files <path-to-sbom>, or use guacone collect --add-vuln-on-ingest files <path-to-sbom> to also query OSV for vulnerability data during ingestion (slower due to rate limits).","If vulnerability data wasn't pulled at ingest time, run the OSV certifier explicitly with guacone certifier osv to populate vulnerability certifications for the ingested packages; it also runs continuously in polling mode on an interval when part of the running compose stack.","Query for vulnerabilities on a specific artifact with guacone query vuln purl \"pkg:...\" (using the package's pURL) or guacone query vuln uri \"<sbom-namespace-or-serialNumber>\" (SPDX documentNamespace or CycloneDX serialNumber) — this syntax requires GUAC v0.8.9 or later.","To check whether a specific vulnerability affects the artifact and see the dependency path to it, add --vuln-id \"<CVE-or-GHSA-id>\" to the query (optionally --num-path N to limit the number of paths returned).","If a query reports missing/incomplete vulnerability certification data, re-run guacone certifier osv to force an immediate re-scan before retrying the query."],"gotchas":["guacone query vuln purl|uri syntax requires GUAC v0.8.9+; older versions only accept guacone query vuln without the purl/uri subcommand distinction.","Vulnerability queries can fail with a 'certify vulnerability node not found' error if the OSV certifier hasn't finished running yet — force it manually with guacone certifier osv rather than assuming ingestion alone populates vulnerability data.","--add-vuln-on-ingest slows ingestion noticeably due to OSV.dev network calls/rate limits; for bulk ingestion it's often faster to ingest first and let the certifier backfill vulnerability data separately."],"contributor":"waymark-seed","created":"2026-07-08T03:11:01.515Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"verified","method":"per-route-fact-check","at":"2026-07-08T03:11:01.515Z"},"url":"https://mcp.waymark.network/r/d7cd7893-64d4-4b33-8273-816af77c8e1d"}