Advancing Transparency and Security in Software: A Deep Dive into SBOM and SPDX
summary
SPDX 3.0 is now published and replaces the old monolithic model with a graph-based model that lets multiple documents and profiles (core, software, licensing, security, provenance, AI, build info) be joined or filtered; the license list contains about 6,855 licenses and exceptions and uses short identifiers for machine matching; the spec is designed to serialize as Tag/Value, JSON, RDF and to produce auto-generated language libraries so tools can read/write SPDX reliably across ecosystems and BOM types (source, build, deploy, runtime).
AI-written summary · about
chapters (14)
- 0:00SBOM and SPDX intro
- 2:58What is SBOM
- 6:57Legal compliance with licenses
- 8:25Security and supply chain risks
- 10:19Regulations driving SBOM
- 13:53SPDX standard origin
- 15:42SPDX license list
- 21:28Creating SPDX documents
- 24:47SPDX 3.0 reimplementation
- 28:18Graph model in SPDX 3.0
- 34:46SBOM types lifecycle
- 39:24SPDX tools overview
- 44:28Participate in SPDX
- 51:42Future of SPDX tooling
related talks
46mAdvancing Transparency and Security in Software: A Deep Dive Into SPDXv3
16mSPDXv3: Advancing Transparency in Software
28mSPDX: Tackling System Risk in Modern Supply Chains
37mSBOM Implementation Reality: From Crawl to Walk - SPDX Lite Pro...
38mSBOM Implementation Reality - the SPDX Lite Profile for First Step
43mExtending SBOMs to Describe AI Systems
40mStrengthening Software Supply Chains: Harmonizing SLSA Provenance and SPDX SBOM for Better Adoption
41mThe State of SBoMs in Embedded