BoF: State of SBOM Tools
summary
Group documents what SBOM tools actually do, what is missing, and where accuracy breaks down: producers can generate SPDX and CycloneDX SBOMs and projects like trust-source provide per-ecosystem generators, but consumers lack reliable parsers and query tools. Licensing metadata is often wrong, different generators produce different dependency graphs for the same project, and standards cannot express some real-world relationships. Priorities are a lightweight CLI/CI generator, robust SPDX/CycloneDX parsers, a Bom query language runtime, and agreed artifact semantics.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 2:50SBOM tool goals
- 13:20SBOM tooling landscape
- 23:15Missing functionality
- 33:11Ecosystem standards
- 40:37SBOM use cases
related talks
37mSBOM Implementation Reality: From Crawl to Walk - SPDX Lite Pro...
23mSBOM adopatability in open source software scanning
29mAuto Generate SBOMs for Your Open Source Project Written in Any Language Running on Any Platform
53mAdvancing Transparency and Security in Software: A Deep Dive into SBOM and SPDX
16mSBOM, the Beginning of Transparency
46mSCA for Containers: The Good, the Bad, and the Truth
30mGetting Real with the Supply Chain: From SBOM Data to Action
11mOSS Supply Chain Security