Using SBOMs for Linux Foundation Projects
summary
Linux Foundation generates a unified SBOM that combines source scanning and dependency analysis for ~260 projects out of ~1,200, finding a 40% rate of key license findings. The pipeline uses Fossology, Trivy, Parlay, CDSBom and a scaffold orchestrator, runs on AWS with a Nexus cache (performance drops from 11 hours to 11 minutes), outputs SPDX 2.3 SPDX files published to GitHub, and produces CSV/notice reports for vulnerability lookup and license compliance aimed to meet NTIA/CISA minimums and evolve toward build SBOM parity.
AI-written summary · about
chapters (14)
- 0:00SBOMs for Linux Foundation projects
- 7:23Source vs build SBOMs
- 12:42Linux Foundation SBOM spec
- 18:48SBOM generation behind scenes
- 23:40Deployment & performance optimizations
- 27:15SBOM for multi-repo projects
- 29:27Live demo: SBOM generation
- 31:36SBOM limitations & future
- 33:19Expanding SBOM coverage
- 35:48Q&A: dependencies & compliance
- 37:55Demo: vulnerability scanning with OSV
- 40:51Generating license files
- 41:11SPDX tooling & community
- 42:38Closing remarks
related talks
35mTransforming SBOMs from Compliance Burden to Security Asset
36mSo I generated over 3000 SBOMS for the CNCF ecosystem
47mThe Missing Link - How we collect and leverage SBOMs
22mBuilding a Robust SBOM Solution with Backstage.io
46mAn SBOM Primer: From Licenses to Security, Know What’s in Your Code, or Someone Else’s!
28mLeverage Kubernetes SPDX Tools to Create Your SBOM
38mThe State of SBOMs
23mSBOM adopatability in open source software scanning