From Kitchen to Table: A Safe Software Journey with SBOMs
summary
Builds produce an SBOM (CycloneDX by default) inside the Spring Boot JAR and CI can extract and enforce it; signed images and attestations are verifiable with Cosign and include embedded SBOMs to prove provenance. Scanners differ (Syft vs an SBOM-derived scan) and using OSV-Scanner against a Liberica hardened base shows “no issues” while older Spring Boot releases show rising CV counts. Store SBOMs in Dependency-Track, enforce Rego/OPA policies, and block deploys when gates detect critical CVs or forbidden licenses.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 3:39Software supply chain risks
- 10:18DevSecOps practices
- 12:47What is an SBOM
- 18:25SBOM formats and trust
- 24:10Generating SBOMs with Spring Boot
- 30:33Analyzing SBOMs with open source tools
- 35:07Verifying container images
- 41:31Integrating SBOMs in CI/CD
- 44:20Automating security decisions
- 48:38Reducing vulnerability workload
- 50:22Conclusion and call to action
related talks
27mSBOM: The Rest Of the Story
34mTransforming SBOMs from Compliance Burden to Security Asset
22mBuilding a Robust SBOM Solution with Backstage.io
01h 26mPractical Software Bill of Materials: From Generation to Distribution Workshop
34mSBOMs: zero to hero in 25 mins!
26mLeveraging SBOMS to Automate Packaging, Transfer, and Reporting of D...
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
34mSo, SBOMs Matter…Now What?