~/talk

Hands-On SBOM

on YouTube 47m
Talkat phpday 2025 · 2025-05-15..05-16· [security]

speaker

name:Arne Blankerts
website:https://blankerts.de

resources

video:https://youtu.be/igpL7QKMcqQ
slides:none on file

summary

Demo shows how to generate SBOM for a PHP application container (composer and npm artifacts included), how to recursively create and merge SBOMs (CycloneDX composer plugin + Syft/sift), and how to upload the merged file to Dependency-Track for automated analysis. The merged SBOM grows to thousands of components, the base PHP FPM image exposes ~879 executables, and the scan surfaces 1 critical, 3 high and 1 medium CVEs, so the pipeline and tooling demonstrably work.

AI-written summary · about

chapters (6)

  1. 0:00Introduction to Software Bill of Materials
  2. 12:24Why ESBOM is essential
  3. 23:13Standards and formats for ESBOM
  4. 31:04Hands-on SBOM generation
  5. 44:24Tools for ESBOM analysis
  6. 46:29Q&A

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.