The SBOM Era: Leaving No Open Source Project Behind With Osskb.org
summary
osskb.org is a free, hash‑based detection backend that matches file and snippet hashes against a 273 million URL knowledge base and returns license and version metadata usable as CycloneDX or SPDX; it integrates with tools like scanoss.py, FOSSology, ORT and FOSSLight, provides a pre-commit hook and GitHub Action for shifting detection left, enforces a 30k files/month free tier (service handles ~800k and targets 1,000,000 scans/week), and exposes an open API while keeping scanned code private.
AI-written summary · about
chapters (9)
- 0:00osskb.org and team intro
- 4:24Scanospy detection demo
- 10:13How osskb.org works
- 20:14License compliance with FOSSology
- 28:30Service scalability
- 30:16Generating CycloneDX/SPDX SBOMs
- 36:57Detecting undeclared components
- 43:21SBOM checks in dev workflows
- 49:01Call for collaboration
related talks
31mOpen Source SCA
43mUsing SBOMs for Linux Foundation Projects
23mSBOM adopatability in open source software scanning
47mThe Missing Link - How we collect and leverage SBOMs
27mSecuring Open Source With SBOM: From Visibility To Trust
30mContinuous Compliance in Open Source: Safety Assurance Through S...
28mGenerating a SPDX SBOM for Your Code in CI Using ORT
35mTransforming SBOMs from Compliance Burden to Security Asset