SPDX: Tackling System Risk in Modern Supply Chains
summary
SPDX 3.0 encodes software, models, datasets and hardware as linked artifacts so system-level risk can be reasoned about using a knowledge graph. The talk gives concrete numbers: about 60% of models and 70% of datasets are undocumented, motivating mandatory provenance and dataset composition fields. Profiles (AI, data, security, software) and a maintained SPDX 3.0 model library let tools emit interoperable BOMs (SBOM/AIBOM/DBOM/HBOM); 3.1 adds foundation-model lifecycle fields, but production tooling is still emerging.
AI-written summary · about
chapters (8)
- 0:00SPDX and supply chain risks
- 4:55SPDX for AI and data security
- 7:24SPDX 3.0 profiles and graphs
- 10:37AI and data profile in SPDX 3.0
- 16:21Regulatory compliance and SPDX future
- 19:35SPDX 3.1 timeline and projects
- 22:25Call to action and community
- 24:33Q&A on AI agents and CycloneDX
related talks
16mSPDXv3: Advancing Transparency in Software
53mAdvancing Transparency and Security in Software: A Deep Dive into SBOM and SPDX
46mAdvancing Transparency and Security in Software: A Deep Dive Into SPDXv3
26mApplication of the Upcoming SPDX Safety Profile
14mKeynote: The Next Steps in Software Supply Chain Security
37mSBOM Implementation Reality: From Crawl to Walk - SPDX Lite Pro...
38mSBOM Implementation Reality - the SPDX Lite Profile for First Step
26mSPDX Dashboard