From SBOM to Dependency Stacks: Making Software Structure Visible
summary
Prototype converts an SPDX 2.3 SBOM into a readable dependency layout by removing cycles, topologically sorting packages, mapping each package to upstream repos (currently GitHub only) and collecting signals to score projects with the OSSF criticality score. Demonstrated on about 10% of a UBI 9.7 image; visualization encodes structure but not yet score-driven sizing or color, lacks non-GitHub forge support and scalable rendering for large SBOMs, and has undergone one major and two minor refactors. SPDX 2.3 provides the input format.
AI-written summary · about
chapters (11)
- 0:00Software package visibility
- 1:25SBOM limitations
- 2:29Dependency graph pipeline
- 3:55Project criticality metrics
- 6:06PyTorch criticality claim
- 7:08Current visualization gaps
- 9:53Future steps
- 10:13Audience questions on visualization styles
- 11:59Audience questions on refactoring and input formats
- 14:29Beyond RPM packages
- 15:11Closing remarks
related talks
43mUsing SBOMs for Linux Foundation Projects
16mKeynote: SBOM is Coming: Why You Should Care and How You Can Help
25mA Primer on Software Bill of Materials for DevSecOps
53mAdvancing Transparency and Security in Software: A Deep Dive into SBOM and SPDX
21mKnow Your JS: SBOMs for Frontend Devs
41mThe State of SBoMs in Embedded
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
27mHow Software Transparency Can Help Save the World