The SBOM Way! The Art of Consuming, Enriching, and Managing Inbound..
Talkat Open Source Summit Europe 2023 · on Thursday, 2023-09-21· at 15:00· Room 0C (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
A new package portlet in SW360 models binary packages separately from source components, ingests CycloneDX and SPDX SBOMs, and links releases by VCS to reduce redundant clearing requests; an example import shows ~1300 packages with 382 missing VCS entries that require enrichment. License scanning runs via FOSSology with about 10–15% of findings auto-resolved, a license compatibility agent auto-concludes some results, and the demo partly succeeds while highlighting where automation still needs human review.
AI-written summary · about
chapters (8)
- 0:00SBOM workflow intro
- 3:30SW360 core features
- 10:20Compliance with Fossology
- 13:36Process SBOMs in SW360
- 16:44Package portlet for SBOMs
- 23:30Demo SBOM import & enrichment
- 31:07Reduce dev compliance workload
- 32:19Q&A on licenses & automation
related talks
42mThe SBOM Way! The Art of Consuming, Enriching, and Managing Inbound..
39mSBOM Automation - Making Compliance Effortless by Consuming, Enrichin...
43mSBOM Management with SW360: Cross-Industry Perspectives and Best Practices
47mThe Missing Link - How we collect and leverage SBOMs
35mTransforming SBOMs from Compliance Burden to Security Asset
23mSBOM adopatability in open source software scanning
43mUsing SBOMs for Linux Foundation Projects
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...