Your SBOM Is Lying To You – Let’s Make It Honest
Talkat Open Source Summit Europe 2025 · on Tuesday, 2025-08-26· at 14:10· Elicium 2B (Elicium Level 1)·
summary
Current SBOMs routinely miss runtime artifacts and build-time inclusions; SBOMit captures build activity with in-toto attestations, records file and system-call traces via witness tracing, and assembles signed, verifiable SBOMs (SPDX/CycloneDX via protobomb) that link each artifact to the step that produced it. The project finds items that post-build scanners miss, reduces false positives, and resists tampering, while noting non‑reproducible builds and compromised compilers remain out of scope. Continuous community work and weekly meetings drive improvements.
AI-written summary · about
chapters (9)
- 0:00SBOM accuracy challenges
- 6:01SBOMs miss components
- 10:20Limitations of build tools
- 13:33In-toto attestations and witness
- 17:05Verifiable SBOMs from attestations
- 20:15SBOMs and attestations complement
- 22:03Security-first SBOM principles
- 23:30Next steps and community
- 39:28Q&A on reproducibility
related talks
32mSBOMit: Making SBOMs Accurate With Attestations
46mSBOMs Are Not Enough
45mSmarter Than Your Average SBOM!
32mAsleep at the Wheel: Getting your SBOMs to pay attention...
26mSBOM X-Ray Superpowers: Making Better SBOMs, Using SBOMs
34mSBOM Quality: We Need More Than a Simple “SBOM Button” for Compliance
27mSBOM: The Rest Of the Story- 45mSmarter Than Your Average SBOM!