Improving Build Time SBoMs
summary
Build‑time SBoMs aim to record the exact inputs, compiler invocations and outputs of a build so consumers can triage CVEs and support attestation and reproducibility. Options compared: file tracing (e.g. strace/ftrace/eBPF) gives very high fidelity but adds orders‑of‑magnitude slowdown and often needs elevated privileges; sandbox/container builds give medium overhead but overestimate inputs; post‑build scans miss static deps; extracting DWARF debug data recovers static libs if debug info exists; a GCC estra plugin records inputs cheaply but requires toolchain adoption.
AI-written summary · about
chapters (8)
- 0:00Introduction to buildtime SBOMs
- 1:46Why buildtime SBOMs matter
- 4:57Methods to generate SBOMs
- 15:20Post-build scan approaches
- 17:49Toolchain-level SBOM generation
- 20:42Kernel and embedded SBOMs
- 23:10Criticism and Rust ecosystem
- 26:42Future of SBOMs and deployment
related talks
41mYour SBOM Is Lying To You – Let’s Make It Honest
41mThe State of SBoMs in Embedded
32mSBOMit: Making SBOMs Accurate With Attestations
34mSBOMs: zero to hero in 25 mins!
24mBack to the Drawing Board: Building Containers with SBoMs
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
28mIn-toto Attestations for What Really Happens in Your Build Pipelin...
50mRealities of SBOM: What Is Under the Hood of SBOM?