Understanding Red Hat's SBOM - The Future of Software Transparency
summary
Red Hat publishes an official Red Hat Build SBOM strategy: GA releases get static SBOMs, RHEL streams produce SBOMs at GA while OpenShift emits per z‑stream updates, and three release tiers exist—public source SBOMs (no validated provenance), licensed build SBOMs (verified licenses/provenance), and NDA-only analyzed SBOMs (build‑pipeline details). SBOMs ship as SPDX today with planned Cyclone DX support, vulnerability state lives in continuously updated CISA VEX files, and a Trusted Profile Analyzer tech‑preview lets users download, upload and get vuln statistics.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 1:26What is SBOM
- 8:40Generating SBOMs at right time
- 10:04SBOM types and use cases
- 14:20SBOMs in product lifecycle
- 17:59SBOMs in the software development lifecycle
- 23:44Red Hat's SBOM approach
- 29:27Challenges in SBOM delivery
- 34:28SBOM benefits and challenges
- 35:11Q&A on trusted profile analyzer
- 35:55Q&A on Red Hat adoption
- 38:27Q&A on SPDX vs CycloneDX
- 39:31Q&A on SBOM ownership
- 41:20Q&A on RPM package SBOMs
- 44:34Q&A on SBOM future
- 45:37Q&A on accessing Red Hat SBOMs
- 47:09Q&A on legal challenges
- 49:21Q&A on SBOMs for vulnerability response
- 53:11Closing remarks
