Software Composition Analysis with Free Tools
summary
Claim: full software composition analysis works with free tools and free data; demonstration scans a Docker Node+Debian image and finds ~3,000 packages and ~8,000 files, resolves package provenance, and checks vulnerabilities using ScanCode Toolkit and the vulnerablecode database. Identification relies on the Package URL (purl) standard to map packages to advisories. Pipelines are simple scripts that extract layers, parse manifests, and query multiple vulnerability sources (shows conflicting CVSS scores 6.8 vs 2.9), and the end-to-end process functions as shown.
AI-written summary · about
chapters (11)
- 0:00Software composition analysis intro
- 1:06Why software composition matters
- 3:13Open source proliferation challenges
- 8:51Focus on deployed code
- 10:14Three package discovery techniques
- 17:08Package provenance with PURL
- 20:41Package URL standard evolution
- 25:17Parsing package manifests
- 29:51Scanning Docker image demo
- 36:14Vulnerability checking with VulnerableCode
- 38:45Free SCA tools summary
related talks
24mHow to Find Secure Software in Open Source Repositories
49mOpen-source vulnerability management? Use the source, Luke!
32mWhat Data Tells Us About Software Supply Chain Security & What To Do About It
35mEnhancing Software Composition Analysis Resilience Against Container Image Obfuscation
52mBuilding Community-Driven Security Analysis for Your .NET Software Supply Chain
32mA Security State Of Mind: Compliance and ...
46mSafely through the dependency minefield using OWASP Dependency Track
40mPanel Discussion: Open Source Supply Chain Security - Are Containers..