Software Bill of Materials (SBoM) for dummies
summary
US government mandates SBoMs; the talk shows concrete steps Fedora is taking: a team of four is converting old Callaway license identifiers to SPDX migration with a burn‑up chart projecting completion after next summer, but dozens of licenses lack SPDX IDs and require weeks–months to add. Demonstrations use rpm queries and a license‑Fedora->SPDX tool to generate SBOM from RPM in 15 minutes. Containers get coarse SBOMs only; license mapping is the real bottleneck.
AI-written summary · about
chapters (12)
- 0:00Introduction to SBOM
- 1:14SBOM utility and limitations
- 3:24Practical analogy for SBOMs
- 5:06Regulatory impact and standards
- 7:14SPDX vs. CycloneDX
- 8:43Generating SBOMs
- 10:28Fedora licensing transition
- 14:40Advanced SBOM types
- 16:42Concluding key takeaways
- 17:35Q&A: SBOM and compliance
- 22:00Explaining the migration chart
- 25:23Final discussion and help
related talks
01h 26mPractical Software Bill of Materials: From Generation to Distribution Workshop
43mUsing SBOMs for Linux Foundation Projects
47mSoftware Bill of Materials - Contents List for Software
32mNext Steps for Software Bill of Materials (SBOM) Generation in Zephyr
35mSBOMs: Navigating the Evolving Landscape of Software Bill of Materials
53mAdvancing Transparency and Security in Software: A Deep Dive into SBOM and SPDX
41mThe State of SBoMs in Embedded
46mAn SBOM Primer: From Licenses to Security, Know What’s in Your Code, or Someone Else’s!