Smarter Than Your Average SBOM!
Talkat Open Source Summit Europe 2023 · on Tuesday, 2023-09-19· at 16:35· Room 0A (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
SBOMs are point-in-time structured manifests (JSON/XML) that are most useful when generated at build time in CI/CD and signed so consumers can revalidate provenance. Examples: a CycloneDX SBOM scores 77 with quality tools and rises after enrichment via Parlay using Ecosystems and OpenSSF Scorecard data plus Snyk vulnerability embeds. Use SBOM Scorecard/OpenSSF tools to gate pipelines, and use VEX/OpenVEX or VDR/CSAF to mark exploitability. Major failure modes are incomplete transitive lists, dependency confusion, compromised CI/signing keys, and tampered provenance, so reproducible builds and signed artifacts are critical.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:06What is an SBOM
- 3:11Why SBOMs matter
- 6:22Trust in SBOMs
- 8:10SBOM formats and testing
- 11:40Enriching SBOMs
- 15:51Managing vulnerabilities
- 17:35VEX and VDR
- 20:01SBOM integrity threats
- 27:19SBOM threats and lifecycle
- 30:07SALSA framework
- 32:12SBOMs in trust systems
- 33:58Q&A: Transferring SBOMs
- 41:54Q&A: Transitive dependencies
- 42:15Q&A: Trust in enriched SBOMs
related talks
45mSmarter Than Your Average SBOM!
27mSBOM: The Rest Of the Story
36mSBOMs, VEX, and Kubernetes
46mSBOMs Are Not Enough
16mKeynote: SBOM is Coming: Why You Should Care and How You Can Help
26mSBOM today: What is the state of SBOMs?
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
34mSBOM Quality: We Need More Than a Simple “SBOM Button” for Compliance