So, SBOMs Matter…Now What?
summary
Paketo Buildpacks integrates Syft as a library to generate SBOMs at each build step (not just the final OCI image), emitting CycloneDX, SPDX and Syft schemas and package identifiers like purl and CPEs so vulnerability scanners can match CVEs; their demo finds many npm packages (and several critical/high CVEs) present during build but absent from the final image. Adoption stats quoted: ~25% produce SBOMs. Implementation takes over a year and outputs per-buildpack SBOMs via Pax CLI.
AI-written summary · about
chapters (7)
- 0:00Introduction to SBOMs
- 3:41Defining useful SBOMs
- 7:26Identifying stakeholders
- 11:54Demo: SBOM generation
- 19:27Storage and accessibility
- 20:57Timing and coverage
- 29:30Q&A and conclusion
related talks
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
38mThe State of SBOMs
46mSBOMs Are Not Enough
22mSBOM: A New Way to Generate a Software Bill of Materials from Your Container Image
27mSBOM: The Rest Of the Story
29mMaking Software Bill of Materials (SBOMs) Actionable
43mA radiography of a SBOM vulnerability scanner
41mThe State of SBoMs in Embedded