Flagship Projects: CycloneDX
summary
CycloneDX presents a claim: a lightweight SBOM format born in 2018 with yearly releases and an active 1.4 draft, focused on inventory, integrity and provenance for supply chain risk. It cites 73% year-over-year growth in open source consumption, supports identifiers like package-url and CPE, plus hashes, nested component assemblies and services. Tooling is real: libraries, GitHub Actions, transforms and signing with code notary and cosine; roughly 40 repositories power a busy ecosystem.
AI-written summary · about
chapters (9)
- 0:00Start
- 8:06Describe complete and accurate inventory
- 8:40Security vulnerability analysis
- 9:16Integrity verification
- 10:14Software package evaluation
- 11:07License identification and compliance
- 11:40Describe complex component assemblies
- 13:53Describe component provenance
- 15:06Capture dependency relationships
related talks
50mSBOM SmackDown: Conquer dragons in the shadows with OWASP CycloneDX
32mCryptographic Governance: Software Supply Chain Security With CBOM
26mLeveraging SBOMS to Automate Packaging, Transfer, and Reporting of D...
47mThe Missing Link - How we collect and leverage SBOMs
36mSBOMs, VEX, and Kubernetes
39mSBOM Automation - Making Compliance Effortless by Consuming, Enrichin...
30mIs CBOM Enough?
40mHow I Learned to Stop Worrying and Love the SBOM