SBOMs: zero to hero in 25 mins!
summary
Crash course gives concrete workflow: use cachy2 to prefetch and lock RPMs, generate an SBOM from that cache (UBI9 build: 192 RPMs, sift reports 210), run sift against the built image to see duplicated/incorrect entries, then diff those SBOMs to produce a clean layered SBOM and set correct CPEs. Covers formats SPDX and CycloneDX, VEX for vulnerability assertions, common tool weaknesses (post-facto scanners miss embedded jars and npm modules) and practical guardrails.
AI-written summary · about
chapters (29)
- 0:00SBOMs introduction
- 1:03Why SBOMs matter after breaches
- 2:28Compliance vs SBOM benefits
- 3:10SBOM types and use cases
- 5:38When to use SBOMs
- 6:18SPDX vs CycloneDX
- 7:45Generating SBOMs: tools and challenges
- 9:11Post-build scanners miss components
- 11:00Build-time vs post-build accuracy
- 12:28Demo: clean SBOM from scratch
- 14:40Demo: prefetching dependencies with Cachi2
- 15:46Demo: container from prefetched RPMs
- 16:31Demo: SBOM from prefetch cache
- 17:56Fixing CPE IDs in SBOMs
- 18:42Demo: adding Go app to container
- 19:25Demo: SBOM for layered image
- 20:26Demo: cleaning SBOM with SiftMath
- 21:52Finalizing accurate SBOM
- 22:35Automating high-accuracy SBOM workflows
- 22:57SBOMs and vulnerability detection limits
- 23:19VEX with SBOMs for precision
- 24:22Tools respecting VEX in SBOMs
- 24:42SBOMs and license compliance
- 25:25Improving license data with ClearlyDefined
- 26:28Referencing SBOMs across artifacts
- 27:12Balancing SBOM detail
- 28:15Scaling SBOM with Trustification
- 29:21Red Hat’s SBOM roadmap
- 29:44Q&A
related talks
57mSBOMs in the Real World: Practical Guidance for Managing Three Common SBOM Scenarios
27mSBOM: The Rest Of the Story
36mSBOMs, VEX, and Kubernetes
46mSBOMs Are Not Enough
34mSo, SBOMs Matter…Now What?
34mSBOM Quality: We Need More Than a Simple “SBOM Button” for Compliance
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
26mSBOM X-Ray Superpowers: Making Better SBOMs, Using SBOMs