Generating a SPDX SBOM for Your Code in CI Using ORT
summary
Builds an automated CI pipeline using OSS Review Toolkit (ORT) to produce traceable SPDX SBOMs, downloading sources, running ScanCode, applying configurable patches stored in a git repo, and emitting SPDX JSON/YAML outputs. Works with ~20 build systems and integrates into GitLab, Jenkins, GitHub; example run on a mime‑types repo finds 355 unique dependencies. Tool caches per‑package scans, evaluates policy rules, and flags mismatches for developer tickets.
AI-written summary · about
chapters (5)
- 0:00Start
- 1:56What information do you need to gather? OPENCHAIN When analyzing Open Source usage, collect information about the identity of the Open may include
- 2:25Questions to ask when comparing SCA tools
- 7:37Tooling Challenges Our experience when trying to introduce automation: Missing / incorrect metadata No sources available
- 8:28Solving challenges is what engineers do
related talks
33mORT Automate compliance using Open Source & InnerSource
33mAutomation of SBOM Assessment in AGL Development Process
43mUsing SBOMs for Linux Foundation Projects
30mContinuous Compliance in Open Source: Safety Assurance Through S...
35mTransforming SBOMs from Compliance Burden to Security Asset
30mORT Server: An open source platform to automate CRA checks
36mSBOMs, VEX, and Kubernetes
18mZero-Touch SBOM Generation: Secure Your Build From the Inside Out