The Current State of SBOMs for End Users
summary
Current state: SBOM formats are inconsistent and checkboxes let empty JSON or Word docs satisfy regulators, while tooling is sparse and fragmented. Protobom aims to represent SBOMs as a queryable graph and bomctl builds a CLI plus storage for practical queries, but interoperability and lossiness converting CycloneDX ↔ SPDX remain unresolved. Syft is the de facto generator yet lacks built‑in build‑time “--sbom-out” integration for many languages; reference implementations (Keycloak) exist but automation and ubiquity are not finished.
AI-written summary · about
chapters (18)
- 0:00Introduction and speaker intro
- 1:04What is an SBOM?
- 2:07SBOM lifecycle and types
- 3:09Regulations driving SBOM adoption
- 4:33Personal journey with SBOMs
- 6:18Zarph and SBOM challenges
- 7:41Community confusion over SBOMs
- 8:45Why SBOM tooling matters
- 9:28SBOM formats overview
- 10:56Regulations as checkboxes
- 12:00Current SBOM tooling landscape
- 14:27Protobom and Bom CTL
- 15:50Build vs runtime SBOMs
- 16:30Consuming SBOMs today
- 17:34Best practices still unclear
- 18:58Future of SBOMs and formats
- 21:43How to get involved
- 22:46Q&A session
related talks
35mBOF: SBOMs for Embedded Systems: What's Working, What's Not?
26mSBOM today: What is the state of SBOMs?
27mSBOM: The Rest Of the Story
38mThe State of SBOMs
38mTeach Your SBOM New Tricks with Bomshell
45mSmarter Than Your Average SBOM!- 45mSmarter Than Your Average SBOM!
41mThe State of SBoMs in Embedded