SBOMs Are Not Enough
summary
SBOMs list components but often miss the build context that matters: CI plugins, compiler and annotation‑processor versions, test‑scope dependencies, and which repository the artifacts came from. Demonstrations use CycloneDX/SPDX, SIFT for images, Spring Boot’s embedded SBOMs and Docker/buildpacks; incidents shown include log4j, an XZ utils supply‑chain backdoor, and a GitHub Actions token compromise. Practical fixes are to generate SBOMs at build time, include test‑scope and CI plugin metadata, and sign SBOMs with in‑toto/Sigstore for enforceable policy and auditing.
AI-written summary · about
chapters (14)
- 0:00Introduction and welcome
- 1:04Speaker introduction and background
- 3:53Software supply chains explained
- 7:05What are SBOMs and why they matter
- 13:51Generating an SBOM demo
- 18:36Scanning container images for SBOMs
- 21:12Limitations of image scanning
- 24:46Why SBOMs are not enough
- 27:13Missing context in SBOMs
- 30:24XZ utils and CI plugin attacks
- 34:43Lessons from past vulnerabilities
- 37:11Providence and supply chain security
- 41:09Path forward and next steps
- 44:38Q&A session
related talks
27mSBOM: The Rest Of the Story
37mSBOMs Aren't Enough. Secure Your Software Supply Chain End-To-End
34mSBOM Quality: We Need More Than a Simple “SBOM Button” for Compliance
36mSBOMs, VEX, and Kubernetes
38mThe State of SBOMs
45mSmarter Than Your Average SBOM!- 45mSmarter Than Your Average SBOM!
41mYour SBOM Is Lying To You – Let’s Make It Honest