Zero-Touch SBOM Generation: Secure Your Build From the Inside Out
summary
A zero‑touch CI pipeline generates and enriches SBOMs automatically, converting CycloneDX→SPDX component lists into SPDX reports with license and copyright data using FOSSology and Python libraries, and integrates with vulnerability feeds. An allowlist fails build policy enforces permitted licenses so builds break early. Applied to Node and Python projects, the system catches surprising mixed‑license cases (Apache2 + BSD‑3 vs GPL2) during development, reducing costly late fixes and proving the approach works in production pipelines.
AI-written summary · about
chapters (12)
- 0:00Zero-touch SBOM generation
- 1:28What is an SBOM
- 3:17Regulatory drivers
- 5:46SBOM in lifecycle
- 7:14Basic SBOM limits
- 8:37Enriching SBOMs for licenses
- 9:42Zero-touch compliance principles
- 11:07Continuous SBOM generation
- 12:33Zero-touch SBOM in CI/CD
- 14:18Enforcing license compliance
- 15:21SBOM formats examples
- 17:26Conclusion
related talks
35mTransforming SBOMs from Compliance Burden to Security Asset
43mUsing SBOMs for Linux Foundation Projects
46mAn SBOM Primer: From Licenses to Security, Know What’s in Your Code, or Someone Else’s!
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
37mSBOM Implementation Reality: From Crawl to Walk - SPDX Lite Pro...
41mThe State of SBoMs in Embedded
29mMaking Software Bill of Materials (SBOMs) Actionable
45mSmarter Than Your Average SBOM!