~/talk

Transforming SBOMs from Compliance Burden to Security Asset

on YouTube 35m
Talkat DevConf.CZ 2026 · on Friday, 2026-06-19· at 13:15· E104 (capacity 72)· [security, kubernetes]

speakers

name:Martin Sikora
links:none on file
name:Ales Raszka
links:none on file

resources

video:https://youtu.be/VOa-cldMHOU
slides:none on file

summary

Automated SBOM lifecycle is integrated into Konflux, producing machine-readable SPDX JSON for every production build and signing artifacts with cosign; a Python CLI called Mobster generates, augments (replacing internal registry refs), validates and splits SBOMs into a hierarchical product→index→image set stored in OCI registries. Stored SBOMs land in Trustify/Trusted Profile Analyzer which maps vulnerabilities across thousands of components, supports policy gating and license checks, and is already running at scale for products with hundreds of thousands of package entries.

AI-written summary · about

chapters (6)

  1. 0:00SBOM transformation intro
  2. 4:38Why SBOMs beyond compliance
  3. 7:06SBOM lifecycle pipeline
  4. 18:37SBOM generation tooling
  5. 27:52Value of complete SBOMs
  6. 30:32Q&A on SBOM signing

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.