SBOMit: Making SBOMs Accurate With Attestations
summary
SBOMit generates SBOMs from in-toto attestations captured by witness at build time, observing filesystem reads/writes, process execution and network fetches rather than inferring them. Tested on ~120 CNCF projects and a focused set of 10, it finds real SBOM gaps (examples: academic reports of ~95% inaccuracy, common practice ~30%). Using eBPF traces (same results as ptrace but ~12% overhead vs ~600%), it augments sift/trivy catalogs and in demos adds 23 extra packages to notation and 7 extra packages to a Python project while flagging a containerd false positive.
AI-written summary · about
chapters (12)
- 0:00SBOMit introduction
- 3:13SBOM inaccuracy reasons
- 5:03Flaws in SBOM generation
- 8:35Attestation-based SBOMs
- 10:00Capturing build attestations
- 13:33SBOMit workflow deep dive
- 16:48Demo: detecting hidden deps
- 23:15Q&A: metadata, false positives
- 25:23Handling CVE flood
- 27:07Recording build tools
- 29:13Managing attestation noise
- 31:01SBOM ecosystem integration
related talks
41mYour SBOM Is Lying To You – Let’s Make It Honest
26mSBOM X-Ray Superpowers: Making Better SBOMs, Using SBOMs
32mAsleep at the Wheel: Getting your SBOMs to pay attention...
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
17mTrusted-SBOM: On the Critical Importance of Verifying SBOMs
01h 26mPractical Software Bill of Materials: From Generation to Distribution Workshop
37mSBOMs Aren't Enough. Secure Your Software Supply Chain End-To-End
45mSmarter Than Your Average SBOM!