SBOM Implementation Reality: From Crawl to Walk - SPDX Lite Pro...

on YouTube ↗37m

" summary

Introduces SPDX Lite as a compact profile of SPDX 3.0 that forces package‑level mandatory fields and makes license data required so companies can produce usable SBOMs quickly; publishes concrete JSON samples on GitHub examples that show mappings to CISA minimum elements, FDA/BSI expectations and CycloneDX, and demonstrates that lightweight SBOMs plus separate VEX handling can meet regulatory baselines while keeping automation and analyst workload practical.

AI-written summary · about

" chapters (8)

1. 0:00Introduction
2. 6:58SPDX Light creation
3. 10:17SPDX Light in 3.0
4. 13:51Global SBOM regulations
5. 21:46SBOM attributes mapping
6. 27:15SBOM operations challenges
7. 29:25OpenChain SBOM Study Group
8. 31:39Q&A

" related talks

• 27mSBOM: The Rest Of the StoryEmily Fox, Nisha Kumar, Allan Friedman · Cloud Native Security Conference North America 2021
• 53mAdvancing Transparency and Security in Software: A Deep Dive into SBOM and SPDXAlexios Zavras · foss-north 2024
• 42mBoF: State of SBOM ToolsNisha Kumar · SupplyChainSecurityCon at Open Source Summit Europe 2022
• 26mSBOM Open QuestionsAlexios Zavras · Open Source Summit Europe 2024
• 43mUsing SBOMs for Linux Foundation ProjectsJeff Shapiro, Gary O'Neall · Open Source Summit North America 2025
• 23mSBOM adopatability in open source software scanningAnitha Dakamarri · Commit Your Code 2025
• 34mSBOMs: zero to hero in 25 mins!Brian Cook · DevConf.US 2024
• 34mSo, SBOMs Matter…Now What?Sophie Wigmore, Frankie Gallina-Jones · KubeCon + CloudNativeCon North America 2022