Software Part Catalog Management Is a Prerequisite for Successful SBOM Creation
summary
Claims an open source parts catalog plus data model and workflow makes SBOM generation with SPDX seamless; implemented on Postgres, Go backend, GraphQL API, Vue UI and CLI, released Apache‑2. Catalog stores every file and profiles, computes a content‑based file verification code (SHA‑256 of sorted file hashes) to deduplicate identical archives, models packages, containers and full Linux runtimes, and handles 120,000+ disclosed components; design separates intrinsic component data from release‑specific extrinsic data and is already in use internally.
AI-written summary · about
chapters (12)
- 0:00SBOM and parts catalog intro
- 6:21Why parts catalog matters
- 9:54Software parts and hierarchy
- 11:42SBOM requirements evolution
- 14:32Component identification demo
- 17:40File verification codes
- 19:27Metadata and profiles
- 22:30Workflow integration
- 24:58Intrinsic vs extrinsic SBOM
- 27:06Parts catalog as data source
- 28:09Catalog tech stack
- 32:44SBOM prep summary
related talks
38mWhat the &#% Is in That SBOM? How to Provide Users What Software Components Are Included
25mIn From the Cold - Open Source as Part of Mainstream Software Asset Management
53mTooling Up for SPDX Software Package Data Exchange
28mThe role of CDEs in securing your software supply chain
42mThe SBOM Way! The Art of Consuming, Enriching, and Managing Inbound..
31mRethinking Data Catalogs: The Promise and Pitfalls
16mSecuring the Modern Software Supply Chain: A Beginner’s Guide To SLSA, SBOM, and Beyond
36mThe Role of Package Managers as Partners in License and Attribution Compliance