SBOM X-Ray Superpowers: Making Better SBOMs, Using SBOMs
summary
Demonstrates a producer-driven workflow that attaches SBOMs to artifact SHA256 fingerprints, records attestations in the Rekor transparency log and uses Sigstore/in-toto for signing so consumers can fetch authoritative metadata. Uses Syft to augment scans and shows a concrete gap: a Go binary scan finds 121 packages from the binary vs 140 from the directory (19 missing). The demo builds, attests, uploads the SBOM and Syft successfully pulls the attestation to reveal additional vulnerabilities.
AI-written summary · about
chapters (4)
related talks
27mSBOM: The Rest Of the Story
34mSBOM Quality: We Need More Than a Simple “SBOM Button” for Compliance
37mSBOMs Aren't Enough. Secure Your Software Supply Chain End-To-End
41mYour SBOM Is Lying To You – Let’s Make It Honest
43mA radiography of a SBOM vulnerability scanner
46mSBOMs Are Not Enough
36mSBOMs, VEX, and Kubernetes
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...