One Pipeline, Three Regulator - SBOM Compliance for the Developer
summary
Claims a single pipeline meets CRA Annex I, NIS‑2 Article 21 and ISO27001 clauses by engineering: sign commits with Sigstore gitsign (relying on Rekor transparency), generate both SPDX and CycloneDX via bomctl/OpenSSF Protobom, cosign SBOMs, and scan with OSV-Scanner to avoid the 2024 CVE fragmentation (70% of CVEs unanalyzed). Implements a self‑hosted Dependency-Track v5 platform ingested by GitHub Actions, backed by Postgres on OpenShift; it works at scale but needs Terraform/API adjustments, NVD rate‑limit handling, SMTP tweaks and fixes for DT v5 format/API breakages.
AI-written summary · about
chapters (10)
- 0:00Introduction and motivation
- 3:40Regulators and compliance rules
- 7:55Proving commit authorship
- 10:44SBOM formats and tools
- 13:13Vulnerability data sources
- 16:23Dependency Track introduction
- 18:29Enterprise adoption strategy
- 21:20Dependency Track showcase
- 26:52Dependency Track v5 challenges
- 33:14Q&A on vulnerability tracking
related talks
26mLeveraging SBOMS to Automate Packaging, Transfer, and Reporting of D...
30mContinuous Compliance in Open Source: Safety Assurance Through S...
36mPolicy To Pipeline: How OSPOs Can Power Regulatory Readines...
46mSafely through the dependency minefield using OWASP Dependency Track
33mSecuring Your Infrastructure as Code Pipeline
36mSBOMs, VEX, and Kubernetes
22mBuilding a Robust SBOM Solution with Backstage.io
39mSBOM Automation - Making Compliance Effortless by Consuming, Enrichin...