Teach Your SBOM New Tricks with Bomshell
summary
bomshell is a CEL-based scripting tool that reads SPDX and CycloneDX (JSON or tag‑value), uses protom as a protom neutral graph IO layer, and runs recipes to query, merge and reshape SBOMs. Demos show extracting a 55-file SBOM, producing package‑only SBOMs, and composing a single‑package binary with a GitHub dependency SBOM that contains ~109,191 relationships. Built in Go (with a Python port starting), integrates with bomb for generation, can output any format and return non‑zero to fail CI.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:26Why Bomshell for SBOMs
- 3:11Protom as SBOM format
- 5:23SBOMs as graphs
- 7:08Protom nodes and lists
- 10:23Protom scope and limits
- 11:26Bomshell on Protom
- 12:12Bomshell operations and CEL
- 15:44Example: transform SBOM files
- 17:50Example: extract SBOM packages
- 21:47Example: compose two SBOMs
- 27:12Final notes and pointers
- 28:36Q&A
- 35:27Q&A
- 36:51Q&A
related talks
29mThe Current State of SBOMs for End Users
27mSBOM: The Rest Of the Story
39mSBOM Automation - Making Compliance Effortless by Consuming, Enrichin...
22mSBOM: A New Way to Generate a Software Bill of Materials from Your Container Image
34mSBOMs: zero to hero in 25 mins!
46mSBOMs Are Not Enough
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
01h 26mPractical Software Bill of Materials: From Generation to Distribution Workshop