Building Signing, Distributing SPDX SBOMs as Artifact Reference Type
summary
Demonstrates storing detached SPDX SBOMs and signatures as registry artifact reference types, using ORAS discover tree to view a graph of image → SBOM → signature, and a mock demo with spdx validate that rejects an image containing a "pepper" package. Uses notary v2 signature formats, turn/oras wrappers and a distribution fork reference implementation so the graph can be copied with tools like oci reg copy into air gapped registries. Prototypes work and major registries plan to ship support.
AI-written summary · about
chapters (8)
- 0:00SUPPLY CHAIN TOWN HALL
- 2:49CHAIN What are the Supply Chain Artifact Types
- 4:03CHAIN Supply Chain Artifact Challenges
- 7:28CHAIN Registries & Reference Types
- 8:19CHAIN Artifact: Reference Type Principals
- 11:29CHAIN Artifact: Reference Types
- 19:11CHAIN Artifact Copying
- 21:15CHAIN OCI Artifact Reference Types TOWN HALL
related talks
40mDistributing Supply Chain Artifacts with OCI & ORAS Artifacts
27mSBOM: The Rest Of the Story
36mSBOMs, VEX, and Kubernetes
26mSBOM X-Ray Superpowers: Making Better SBOMs, Using SBOMs
35mTransforming SBOMs from Compliance Burden to Security Asset
33mAutomation of SBOM Assessment in AGL Development Process
32mBack to the Drawing Board: Building Containers with SBoMs
37mSBOM Implementation Reality: From Crawl to Walk - SPDX Lite Pro...