Enhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
summary
SBOM reference implementations for Python, Java and JavaScript produce pipelines that augment Syft/Trivy output with top-level metadata, enrich thousands of components via Parlay and BOM APIs, verify format and quality (example score 8.3), and sign artifacts with cosign for provenance. For large projects (1.2M files across thousands of repos) caching proxies cut augmentation time from ~12 hours to minutes. Recommendations: prefer build-time SBOMs, include package and content identifiers, and publish CycloneDX or SPDX JSON alongside releases.
AI-written summary · about
chapters (15)
- 0:00Enhancing SBOM generation
- 1:23Key SBOM improvements
- 3:28SBOM producer lifecycle
- 6:16Automating SBOM metadata
- 8:23Enriching SBOMs with details
- 10:10Verifying SBOM quality
- 13:16Signing SBOMs
- 14:39CISA and Linux Foundation lessons
- 16:24SBOM generation pitfalls
- 20:11SBOM standards mapping
- 21:37SBOM identifier ambiguities
- 23:43Better SBOM tools
- 25:05Optimizing SBOM performance
- 26:48SBOM resources and next steps
- 27:33Q&A on SBOMs
related talks
01h 26mPractical Software Bill of Materials: From Generation to Distribution Workshop
34mSo, SBOMs Matter…Now What?
22mBuilding a Robust SBOM Solution with Backstage.io
36mSBOMs, VEX, and Kubernetes
27mSBOM: The Rest Of the Story
45mSmarter Than Your Average SBOM!
46mSBOMs Are Not Enough- 45mSmarter Than Your Average SBOM!