SBOM & Vulnerabilities in SEAPATH
summary
SEAPATH generates SBOMs (Yocto builds emit SPDX while live systems use CycloneDX), then merges those BOMs and scans public sources — NVD and distribution security trackers — to produce a vulnerability dashboard with per-CVE severity, affected packages, and an estimated time-to-fix. The team builds and open-sources VulnScout.io to perform the merging, scanning and reporting; it runs as a Docker pipeline, works on Debian-based images today, and is planned for CentOS support.
AI-written summary · about
chapters (7)
- 0:00Introduction to SEAPATH
- 3:56Managing vulnerabilities in SEAPATH
- 10:54Generating SBOM for security
- 16:20Introducing Vulcot tool
- 18:56Vulcot demo and workflow
- 27:05Future plans for Vulcot
- 28:30Q&A session
related talks
40mSBOM Ingestion and Analysis at New York-Presbyterian Hospital
43mA radiography of a SBOM vulnerability scanner
36mSEAPATH: A LF Energy Project for Critical Infrastructure with an...
34mSo, SBOMs Matter…Now What?- 36mSEAPATH: A LF Energy Project for Critical Infrastructure with an Emphasis on Software Supply Chain Security
27mPre-Packaging CRA and NIS2 Compliance: The SEAPATH Approach
49mSBOMs for Evil: From Software Supply Chain Documentation to an Attack Path
29mUnlocking the Power of SBOMs: A Deep Dive into Risk Management and Cybersecurity Posture