Towards Quality SBOMs: The OpenChain Telco SBOM Guide
Talkat Open Source Summit Europe 2025 · on Wednesday, 2025-08-27· at 16:20· Elicium 2A (Elicium Level 1)·
summary
The OpenChain Telco SBOM Guide v1.1 mandates SPDX 2.2/2.3 output (JSON or tag‑value), requires NTIA minimum elements and PURL identifiers, and specifies delivery timing (no later than software delivery) with a recommended 18‑month availability window. Nokia implements the guide and ships an Apache‑2.0 Python validator openchain‑telco‑sbom‑validator (v0.3.2) that validates SPDX syntax, checks mandatory vs recommended fields, resolves recursive SPDX relationships, verifies download URLs and checksums, and accepts Yocto’s package verification code.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:30OpenChain project
- 2:56OpenChain Telco SBOM Guide purpose
- 5:06Guide development process
- 6:55SBOM content requirements
- 9:06NTIA elements and SBOM types
- 11:41Mandatory SBOM creation fields
- 13:49Package-level SBOM content
- 15:39Package URLs as identifiers
- 18:54SBOM scope and timing
- 21:48SBOM recommendations and confidentiality
- 24:22Version 1.1 updates
- 27:40Telco SBOM Validator overview
- 33:12Validator usage and outputs
- 35:43Nokia adoption plans
- 36:53OpenChain SBOM Study Group
- 37:35Q&A
related talks
31mTelco Supply Chain Security: Implementing ISO 18974 & SBOM
26mSBOM Open Questions
46mAn SBOM Primer: From Licenses to Security, Know What’s in Your Code, or Someone Else’s!
38mSBOM Implementation Reality - the SPDX Lite Profile for First Step
30mTransparency in the Software Supply Chain: Making SBOM a Reality
53mAdvancing Transparency and Security in Software: A Deep Dive into SBOM and SPDX
35mBOF: SBOMs for Embedded Systems: What's Working, What's Not?
29mThe Current State of SBOMs for End Users