Microservice Supply Chain and the Ortelius Application SBOMs
summary
Ortelius catalogs microservices and their versions in a relational registry, consumes each component SBOM, CVEs, Swagger and deployment metadata from CI/CD and artifact repos, and automatically generates aggregated application-level SBOMs by mapping many-to-many component→application relationships. It creates logical release candidates for every affected application version, shows blast radius and deployed clusters, and early adopters report ~50% less sprawl and 1–2 hours saved per release. The project is open source in the CD Foundation and explores blockchain for SBOM immutability.
AI-written summary · about
chapters (10)
- 0:00Start
- 2:29The Demand for Hardening the Supply Chain
- 3:33The Biden Administration Steps in
- 6:56Loss of the Application Version
- 8:12The Need for Service Governance
- 9:35Meet the Ortelius Catalog for Service Governance
- 11:53Meet the Ortelius Leadership
- 13:39Meet the Ortelius Committers
- 14:18Meet the Users
- 25:25Component and Application Versions
related talks
41mManaging Application Level SBOMs with Ortelius
34mTransforming SBOMs from Compliance Burden to Security Asset
22mGuardians of Code: Continuously Monitoring Security and DevOps Compliance
35mTransforming SBOMs from Compliance Burden to Security Asset
27mSecuring the Software Supply Chain: Integrating OpenSSF Scorecard, Jenkins, and the O...
31mTelco Supply Chain Security: Implementing ISO 18974 & SBOM
01h 26mPractical Software Bill of Materials: From Generation to Distribution Workshop
11mOSS Supply Chain Security