Continuous Compliance in Open Source: Safety Assurance Through S...
summary
Claims that an SBOM-driven pipeline turns safety compliance from weeks of manual review into minutes of automated action, using SPDX 3.1 annotations and ELISA’s BASIL tool to produce safety-annotated SBOMs. Built a reference platform (OpenFusel CC) that ingests those SBOMs, performs semantic diffs, multihop traceability, policy evaluation and CI/CD gating; it flags only impacted artifacts and can block deploys. Cites 70–90% OSS composition and 97% OSS adoption as the urgency for adoption.
AI-written summary · about
chapters (12)
- 0:00Continuous compliance intro
- 1:07Open source safety challenges
- 4:42Elisa and SPDX standards
- 7:35SBOMs in SPDX 3.1
- 10:06Basil tool for SBOMs
- 12:15Compliance platform workflow
- 14:48Compliance automation building blocks
- 19:04AI-enhanced compliance future
- 21:15Implementation steps
- 24:53Open-source in regulated industries
- 27:20OpenFuser CC in DevOps
- 29:11Key takeaways
related talks
23mSBOM adopatability in open source software scanning
35mTransforming SBOMs from Compliance Burden to Security Asset
33mAutomation of SBOM Assessment in AGL Development Process
27mSecuring Open Source With SBOM: From Visibility To Trust
35mOne Pipeline, Three Regulator - SBOM Compliance for the Developer
29mMaking Software Bill of Materials (SBOMs) Actionable
45mSmarter Than Your Average SBOM!
34mSBOM Quality: We Need More Than a Simple “SBOM Button” for Compliance