SW360 SBOM: Managing Vulnerability Information, SPDX Documents and New Depen...
summary
SW360 is a live SBOM manager that already implements vulnerability registration via REST API and web UI, imports and exports SPDX 2.2 and 2.3 to create components and releases, and lets users store and edit SPDX documents per release. A new feature builds a dynamic dependency network linking projects to component releases so transitive versions update across projects. Installation via Docker Compose is provided, CycloneDX support and further dependency APIs are in progress, and the demo shows these features functioning end to end.
AI-written summary · about
chapters (10)
- 0:00SW360 introduction
- 3:01Why SBOMs matter
- 5:10SW360 data architecture
- 8:15License management
- 12:17SW360 docs & roadmap
- 15:54Vulnerability management
- 18:08Import SPDX docs
- 21:59Dependency network
- 28:34Conclusion & updates
- 29:41Q&A
related talks
13mSW360 SBOM and License Obligation Management
39mSBOM Automation - Making Compliance Effortless by Consuming, Enrichin...
37mSBOM Implementation Reality: From Crawl to Walk - SPDX Lite Pro...
27mHow Software Transparency Can Help Save the World
27mSBOM: The Rest Of the Story
35mSBOMs: Navigating the Evolving Landscape of Software Bill of Materials
47mThe Missing Link - How we collect and leverage SBOMs
25mA Primer on Software Bill of Materials for DevSecOps