Contextual SBOMs: Unlocking Precise Vulnerability Management with Build-Time Content Intelligence
summary
Traditional flat SBOMs leave teams guessing where vulnerabilities come from; Contextual SBOMs map every artifact to the build step that introduced it using SPDX relationships like CONTAINS, DESCENDANT_OF and BUILT_TOOL_OF, plus package URLs, checksums and package verification codes. The Hermeto project implements this for multistage containers (examples use UBI Python and Golang builders), enabling automated, correct rebuild order and targeted owner notification while flagging custom binaries without unique IDs as uncertain origin under Contextual SBOMs.
AI-written summary · about
chapters (8)
- 0:00Contextual SBOMs intro
- 1:54Standard SBOMs promises and gaps
- 6:11Why traditional SBOM analysis fails
- 11:34Contextual SBOMs solve provenance gaps
- 16:37Multi-stage builds and SBOM mapping
- 23:18Impact on vulnerability remediation
- 26:53Challenges and future of SBOMs
- 27:14Key takeaways & Q&A
related talks
46mSBOMs Are Not Enough
36mSBOMs, VEX, and Kubernetes
29mUnlocking the Power of SBOMs: A Deep Dive into Risk Management and Cybersecurity Posture
38mThe State of SBOMs
45mSmarter Than Your Average SBOM!
35mTransforming SBOMs from Compliance Burden to Security Asset
27mSBOM: The Rest Of the Story
39mSecure Your Supply Chain: Adding a Software Bill of Materials to Your Containers to Improve...