Automation of SBOM Assessment in AGL Development Process
Talkat Open Source Summit Japan + AI_dev: Open Source GenAI & ML Summit + Automotive Linux Summit 2025 · 2025-12-08..12-10·
summary
Prototype pipeline generates SPDX3 JSON-LD from Yocto + BitBake, normalizes it with a simple converter using SPDX3 JSON-LD + sparkle/shACL, and evaluates policies with Open Policy Agent (Rego) inside a Docker-based reference repo. Example policies automatically flag GPLv3-family packages and surface unknown/non-OSI licenses; approved licenses move out of the “needs review” list. Prototype works for license screening but shows tooling gaps (missing supplier/download fields, immature SPDX3 support) and plans CVE checks and CIAG integration.
AI-written summary · about
chapters (7)
- 0:003A project introduction
- 1:47AGL build system overview
- 5:00SBOM automation importance
- 8:17SBOM verification pipeline
- 15:10Risk analysis implementation
- 27:42Next steps and takeaways
- 30:32Q&A on SBOM enrichment
related talks
53mAdvancing Transparency and Security in Software: A Deep Dive into SBOM and SPDX
30mContinuous Compliance in Open Source: Safety Assurance Through S...
28mLeverage Kubernetes SPDX Tools to Create Your SBOM
42mPractical SBOM Management with Zephyr and SPDX
28mGenerating a SPDX SBOM for Your Code in CI Using ORT
40mStrengthening Software Supply Chains: Harmonizing SLSA Provenance and SPDX SBOM for Better Adoption
35mTransforming SBOMs from Compliance Burden to Security Asset
43mUsing SBOMs for Linux Foundation Projects