{Fast, Correct, Secure} - Choose Three
summary
Bazel users get a concrete report: EngFlow moves from ad hoc checked‑in license targets and a brittle manual collection to an aspect‑based approach and the new rules_license 1.0, with a generate_sbom (SPDX only) toolchain today. Gaps remain: no reliable transitive SBOM harvesting, workspace SBOMs are immature, prebuilt artifacts need imported SBOMs, and remote execution/caching lacks provenance proof — they propose protocol changes to support signed action results to meet higher SLSA levels.
AI-written summary · about
chapters (12)
- 0:00Supply chain security intro
- 1:02Compliance and vulnerability needs
- 2:25What is an SBOM
- 5:39Nflow’s SBOM journey
- 8:11License management evolution
- 12:32rules_license for Bazel
- 15:45Why SBOMs matter
- 16:29Salsa framework
- 18:13Build artifact security levels
- 21:07Remote execution security gaps
- 24:02rules_license gaps
- 24:43Closing remarks
related talks
30mContinuous Compliance in Open Source: Safety Assurance Through S...
43mUsing SBOMs for Linux Foundation Projects
36mSBOMs, VEX, and Kubernetes
34mSBOM Quality: We Need More Than a Simple “SBOM Button” for Compliance
22mBuilding a Robust SBOM Solution with Backstage.io
34mSBOMs: zero to hero in 25 mins!
18mZero-Touch SBOM Generation: Secure Your Build From the Inside Out
45mSmarter Than Your Average SBOM!