Lock the Chef in the Kitchen: Enabling Accurate SBOMs Via Hermetic Builds
summary
Hermetto is a CLI that reads manifests, downloads all declared packages (npm/yarn, pip, Cargo, Go modules, bundler, plus generic URL fetches and partial RPM support), emits an SBOM and arranges an offline mirror, and supplies env/config overrides so builds run with network none and only those artifacts. CI pipelines mount Hermetto’s output and pass its variables; builds fail if undeclared dependencies are required, giving true hermetic builds and practical SBOM completeness while noting parent-image and undetected local-host artifacts remain out of scope.
AI-written summary · about
chapters (15)
- 0:00SBOMs and Hermetic Builds
- 2:09Reverse engineering SBOMs
- 3:55Analyzed SBOMs fail for bundles
- 5:22Source SBOMs missing deps
- 7:28Source + analyzed SBOMs
- 8:30Build-time SBOM challenges
- 9:55Introducing Hermetto
- 12:26Hermetto prefetches deps
- 13:51Network-isolated containers
- 14:35Confidence in SBOMs
- 15:42Hermetto limits and integration
- 16:23Conflux pipeline and resources
- 16:43Q&A: Full dependency lists
- 17:26Q&A: Hermetto vs air-gapped
- 18:13Q&A: Local binaries
related talks
36mContextual SBOMs: Unlocking Precise Vulnerability Management with Build-Time Content Intelligence
37mDockerize Securely: SBOMs + Attestations + Bake
26mLeveraging SBOMS to Automate Packaging, Transfer, and Reporting of D...
23mSupply Chain Security using Free and Open Tools
45mPractical Software Supply Chain Security Solutions
26mAn OSS project's attempt to secure it's supply chain
28mIn-toto Attestations for What Really Happens in Your Build Pipelin...
35mTransforming SBOMs from Compliance Burden to Security Asset