SEPIA - Validate your SBOM and More
summary
SEPIA is a web app that validates SPDX and CycloneDX SBOMs against user-selected schemas, shows field-level errors, lets users edit errors inline, and merges two already-valid SBOMs (duplicates remain and require manual curation). Code and a curated schema library live on GitHub, conversion and CI automation are on the roadmap, and current usage is browser-driven only. The claim is that automated validation plus community-curated schemas reduces lost or altered compliance data during merging and exchange.
AI-written summary · about
chapters (15)
- 0:00SEPIA introduction
- 1:47Core problems
- 3:13SBOM history challenges
- 5:03Regulatory compliance
- 7:51SBOM formats issues
- 10:27SEPIA workflow features
- 15:23SBOM validation demo
- 17:30Merging SBOMs duplicates
- 20:00SEPIA features roadmap
- 23:11Open sourcing SEPIA
- 26:47Merging SBOMs demo
- 28:13Schema libraries focus
- 30:23Schema contributions call
- 31:25Future steps engagement
- 32:06Q&A
related talks
37mSBOM & Vulnerabilities in SEAPATH
23mSBOM adopatability in open source software scanning
46mAn SBOM Primer: From Licenses to Security, Know What’s in Your Code, or Someone Else’s!
30mContinuous Compliance in Open Source: Safety Assurance Through S...
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
31mOpen Source SCA
45mSmarter Than Your Average SBOM!
42mPractical SBOM Management with Zephyr and SPDX