~/talk

So I generated over 3000 SBOMS for the CNCF ecosystem

on YouTube 36m
Talkat ContainerDays Hamburg 2026 · 2026-09-02..09-04· [security, devops-and-delivery]

speaker

name:Mario Fahlandt
website:https://lwcn.dev

resources

video:https://youtu.be/AjCkBuKj_F4
slides:none on file

summary

A CNCF-wide pipeline generates 12,500 SBOMs from landscape-sourced releases, using Wayel for multi‑language SBOMs, GitHub Actions in 2,500+ parallel jobs, S3 storage, ClickHouse ingestion and the bombhorde UI/API. Scans cover 228 projects plus ~1,700 repos; common findings are missing/incorrect license metadata, archived or unused transitive deps, and inconsistent SBOM formats. Problems encountered: GitHub artifact/UI breakage and API rate limits. Outcome: automated enrichment with OSV/GitHub license checks, queriable DB, and planned VEX auto-generation (LLM-assisted) for maintainer sign-off.

AI-written summary · about

chapters (7)

  1. 0:00Introduction and SBOM basics
  2. 4:29CNCF projects and license challenges
  3. 8:45Generating SBOMs at scale
  4. 13:46Introducing BombHorde platform
  5. 23:01Tool stack and open source contributions
  6. 27:28Open source sustainability and CRA
  7. 30:20Key takeaways and next steps

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.