SBOM Open Questions
summary
SPDX 3 is released and the field still lacks operational answers: which products get SBOMs, when they are generated in CI/CD, and whether SBOMs list only top-level or full transitive dependencies. Organizations adopt the NTIA minimum elements or embed full proprietary details then gate access, creating distribution and access-control dilemmas. Legal liability for errors remains unresolved, sector groups like OpenChain Telco prototype policies, and the biggest gap is usable, painless SBOM tooling that produces trustworthy, machine-linkable inventories.
AI-written summary · about
chapters (12)
- 0:00SBOM open questions intro
- 1:03SBOM practices evolution
- 2:30SBOM lifecycle milestones
- 4:34SBOM scope and criteria
- 6:38SBOM visibility and legal
- 9:26SBOM operational challenges
- 11:15Industry SBOM initiatives
- 13:45Q&A SBOM regulations
- 17:08Q&A SBOM mixed-license
- 19:36Q&A SBOM communities
- 22:29Q&A enforcing SBOM supply
- 24:30SBOM tooling and trust
related talks
40mDBOM and SBOM: New Options For Better Supply Chain Cybersecurity
27mSBOM: The Rest Of the Story
30mTransparency in the Software Supply Chain: Making SBOM a Reality
52mThe World on SBOMs
35mSBOMs: Navigating the Evolving Landscape of Software Bill of Materials
29mThe Current State of SBOMs for End Users
22mSBOM and Security Transparency - How it all fits together
46mAn SBOM Primer: From Licenses to Security, Know What’s in Your Code, or Someone Else’s!