Leveraging SBOMS to Automate Packaging, Transfer, and Reporting of D...
summary
Claims an automated pipeline that packages, validates and moves dependencies into air‑gapped secure environments using CycloneDX SBOMs as the packaging format and a manifest to declare source registries. Uses Hoppr/Hopper with a plugin architecture to collect purls, run scanners (trivy, grype, gimnasium), augment SBOMs with CVE/VEX metadata, and produce a tar bundle plus attestations. Integrates renovate + semantic-release to trigger updates, snapshots deltas (consolidated vs delivered) to minimize transfers, and runs successfully in a GitLab/Gitpod demo.
AI-written summary · about
chapters (11)
- 0:00Start
- 0:31Premise
- 1:24Problem
- 3:37Leveraging Other Excellent Projects
- 5:26Multiple teams, Single Process
- 6:07Dataflow
- 9:53Project Dependency Updates
- 10:47Hurdles
- 12:19Advantages
- 13:09Demo Features
- 22:14Questions?
related talks
39mSBOM Automation - Making Compliance Effortless by Consuming, Enrichin...
22mBuilding a Robust SBOM Solution with Backstage.io
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
23mSupply Chain Security using Free and Open Tools
35mTransforming SBOMs from Compliance Burden to Security Asset
34mTransforming SBOMs from Compliance Burden to Security Asset
35mOne Pipeline, Three Regulator - SBOM Compliance for the Developer
42mThe SBOM Way! The Art of Consuming, Enriching, and Managing Inbound..