SCA for Containers: The Good, the Bad, and the Truth
summary
A project attempts an SBOM Clarity index by running many open and commercial SCA tools against common container bases and finds frequent failures: invalid or nonconformant CycloneDX output, wildly inconsistent identifiers, and package URL chaos that prevents reliable matching. Techniques that help are reading OS package databases, checksum matching, and parsing Go build info from binaries, but no tool achieves full coverage and license detection is often incorrect, so tracking what gets added to images and a community-maintained reference dataset are recommended.
AI-written summary · about
chapters (8)
- 0:00SCA for containers intro
- 3:36Containers and SBOMs
- 10:18Container compliance challenges
- 15:42Software composition analysis techniques
- 22:46Evaluating SCA tool capabilities
- 31:23SCA tool limitations
- 36:41Recommendations for improvement
- 37:50Q&A
related talks
46mSCA for Containers: The Good, the Bad, and the Truth
23mSBOM adopatability in open source software scanning
24mBack to the Drawing Board: Building Containers with SBoMs
38mThe State of SBOMs
30mWhat Is Going On In Your Source Code? Understanding SCA In Plain Language
42mBoF: State of SBOM Tools
11mElephant in the Room: How Supply Chain Security Standards Are Not St...
32mBack to the Drawing Board: Building Containers with SBoMs