Secure Your Supply Chain: Adding a Software Bill of Materials to Your Containers to Improve...
summary
Claim: generating a Software Bill of Materials tied to an image digest makes vulnerability and compliance checks orders of magnitude faster and more precise. Implementation uses sift to untar and enumerate OS and language packages, outputs SPDX or CycloneDX, and feeds gripe to produce vulnerability lists. Example builds show a 15s image scan vs ~1.5s from an SBOM. Demos include Jenkins and GitHub Actions flows that sign artifacts with cosign, publish attestations, and fail pipelines on high-severity findings.
AI-written summary · about
chapters (9)
- 0:00Intro
- 1:38Attack Types
- 7:20Container Images
- 11:32What is an Sbomb
- 19:25What do Sbombs do
- 25:15Demos
- 28:15Vulnerability Check
- 30:00Questions
- 33:50Best Practices
related talks
25mA Primer on Software Bill of Materials for DevSecOps
29mMaking Software Bill of Materials (SBOMs) Actionable
01h 26mPractical Software Bill of Materials: From Generation to Distribution Workshop
35mSBOMs: Navigating the Evolving Landscape of Software Bill of Materials
22mSBOM: A New Way to Generate a Software Bill of Materials from Your Container Image
38mSecuring the chains: Building defensive layers for software supply chains
23mSupply Chain Security using Free and Open Tools
08mKeynote: Approaching the SBOM: Best Practice for Software Supply Chain Security