~/talk

BOF: SBOMs for Embedded Systems: What's Working, What's Not?

on YouTube 35m
Talkat Embedded Linux Conference @ Open Source Summit North America 2022 · on Thursday, 2022-06-23· at 14:05· Room 201/202 (Level 2), JW Marriott Austin, 110 E 2nd Street Austin, TX 78701· [security]

speaker

name:Kate Stewart
website:https://divyamohan.com

resources

video:https://youtu.be/E17RvPlVbQI
slides:none on file

summary

SBOM formats in use today include SPDX (now an international standard), CycloneDX and SWID, and tool chains like Yocto/“Octo” and Zephyr are already producing machine-readable SBOMs — Zephyr emits three SBOMs per Zephyr build (sources, SDK/app, build) and a survey shows 40% adoption in embedded projects. Key specifics: hashes debated and not mandatory, linkage to CPE/VEX and gitbom for fast matching, dashboards like Daggerboard consume SBOMs for vulnerability monitoring, and regulators (FDA, automotive, energy) run active proofs of concept.

AI-written summary · about

chapters (4)

  1. 0:00Start
  2. 7:17Firmware
  3. 16:49The Build Flow
  4. 32:34Build Working Group

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.