~/talk

Transforming SBOMs from Compliance Burden to Security Asset

on YouTube 34m
Talkat DevConf.IN 2026 · on Saturday, 2026-02-14· at 14:10· VYAS - 1 - Room#VY102· [security, devops-and-delivery]

speakers

name:Martin Sikora
links:none on file
name:Ales Raszka
links:none on file

resources

video:https://youtu.be/IDHjweKs0PM
slides:none on file

summary

Konflux integrates an automated SBOM lifecycle that uses Mobster to run Syft-like scanners during builds, emit SPDX/CycloneDX SBOMs per OCI image and index, cryptographically sign artifacts with cosign, and upload everything to an OCI registry and Trustify/ Trusted Profile Analyzer for querying. Generated SBOMs are linked (product → image → arch → packages), validated by Conformer/ policy checks that can block releases, and enable portfolio-wide tracing of vulnerabilities across thousands of components for targeted, large-scale remediation.

AI-written summary · about

chapters (8)

  1. 0:00SBOM transformation intro
  2. 3:56Different bill of materials
  3. 10:01SBOMs beyond compliance
  4. 16:41Building SBOMs with Conflux Mobster
  5. 24:14Storing SBOMs with Trustify
  6. 26:01Accurate complete SBOMs value
  7. 30:12SBOMs and SDLC alignment
  8. 33:47Q&A

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.