How I Learned to Stop Worrying and Love the SBOM
summary
Eclipse Adoptium publishes a CycloneDX SBOM alongside Temurin binaries (over ~500 million downloads total) listing ~100+ components, generated in CI/CD and drilled down with STrace to distinguish full dependency tracking from the smaller reproducibility subset. Repro builds produce bite-for-bite identical JDK 17 and 19+ artifacts on Linux and macOS, Windows work is in progress, and SBOMs live on the project API so consumers can scan for vulnerabilities, compare builds, and automate rebuilds. CycloneDX SBOM
AI-written summary · about
chapters (22)
- 0:00Intro
- 1:23Agenda
- 1:40What is an SBOM
- 2:54SBOM Materials
- 5:43List of Ingredients
- 6:11Purpose
- 8:02Tools
- 10:10Storage Formats
- 11:12SBOM Projects
- 12:48Trusted Software Initiative
- 15:11Salsa
- 16:11Tamron
- 16:31Frameworks
- 17:56Dependencies
- 19:15Config View
- 19:45Reproducible Build Story
- 22:03Comparing Builds
- 22:46Positive Side Effects
- 24:27Summary
- 29:29Maven
- 32:35Saving artifacts
- 35:54Security alerts
related talks
50mSBOM SmackDown: Conquer dragons in the shadows with OWASP CycloneDX
34mSBOMs: zero to hero in 25 mins!
38mThe State of SBOMs
46mSBOMs Are Not Enough
39mSBOM Automation - Making Compliance Effortless by Consuming, Enrichin...
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
32mCryptographic Governance: Software Supply Chain Security With CBOM
47mThe Missing Link - How we collect and leverage SBOMs