Practical Software Bill of Materials: From Generation to Distribution Workshop
summary
SBOMs are generated with Trivy (or Syft), augmented with sbom-azim or a checked-in JSON and jq, then enriched via Parlay(ecosystems) to add licenses, repos and docs; verification uses sbomqs (NTIA checks) and the run shows supplier metadata rising from 0 to ~2,000 of 4,000 components. Signatures use cosign/Sigstore and attestations (bind) wrap predicates into verifiable bundles; bombl fetches/exports SBOM trees and pushes to OCI; GUAC and Dependency-Track ingest for continuous monitoring and prioritization.
AI-written summary · about
chapters (14)
- 0:00Workshop presenters
- 3:14Workshop agenda
- 5:02SBOM generation challenges
- 10:00Top-level SBOM metadata
- 16:18Enriching SBOM components
- 24:23Verifying SBOM quality
- 30:13Signing SBOMs
- 37:19SBOM attestations
- 45:01Distributing SBOMs
- 50:09Verifying SBOMs
- 57:24Bombl for SBOMs
- 1:02:23SBOMs in vulnerability management
- 1:19:19Future SBOM standards
- 1:25:44Workshop recap
related talks
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
27mSBOM: The Rest Of the Story
29mMaking Software Bill of Materials (SBOMs) Actionable
35mSBOMs: Navigating the Evolving Landscape of Software Bill of Materials
35mTransforming SBOMs from Compliance Burden to Security Asset
39mSecure Your Supply Chain: Adding a Software Bill of Materials to Your Containers to Improve...
22mBuilding a Robust SBOM Solution with Backstage.io
36mSBOMs, VEX, and Kubernetes