Tracking Software Dependencies
summary
Covers methods for accurately identifying software elements (applications, libraries, components, files, snippets) despite multiple naming schemes, and for expressing the dependency relationships between those elements for security use cases. Describes approaches using external references and the relationship types used in SPDX SBOMs, and demonstrates a proof‑of‑concept tool that queries the OSV vulnerability database using an SPDX document with relationship information.
AI-written summary · about
related talks
15mFrom SBOM to Dependency Stacks: Making Software Structure Visible
25mA Primer on Software Bill of Materials for DevSecOps
53mAdvancing Transparency and Security in Software: A Deep Dive into SBOM and SPDX
16mKeynote: SBOM is Coming: Why You Should Care and How You Can Help
23mSupply Chain Security using Free and Open Tools
54mSupply Chain Sec /w Dependency Track
46mAn SBOM Primer: From Licenses to Security, Know What’s in Your Code, or Someone Else’s!
46mSafely through the dependency minefield using OWASP Dependency Track