Composing the Ultimate SBOM
summary
Argues that post-build scanners miss build and dependency metadata and demonstrates a proof‑of‑concept Micro-SBOMs workflow that generates 205 per-package SBOMs for a Cinnamon install then SPDX composition tool that merges them into one SPDX document, de‑duplicates entries, updates relationships to produce an accurate dependency graph, and outputs tag‑value or JSON. Shows the composer operates on any valid SPDX files (mixed formats accepted) and positions composition as the way to get high‑fidelity, operational SBOMs.
AI-written summary · about
chapters (7)
- 0:00Start
- 5:07Machine-readable Dependency Data
- 6:30The SBOM Community Standards
- 11:12The Landscape of Tools
- 15:46Supply chain Levels for Software Artifacts (SLSA)
- 19:52DEMO
- 24:12Takeaways
related talks
29mAuto Generate SBOMs for Your Open Source Project Written in Any Language Running on Any Platform
34mSo, SBOMs Matter…Now What?
43mUsing SBOMs for Linux Foundation Projects
37mSBOM Implementation Reality: From Crawl to Walk - SPDX Lite Pro...
27mSBOM: The Rest Of the Story
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
25mA Primer on Software Bill of Materials for DevSecOps
01h 26mPractical Software Bill of Materials: From Generation to Distribution Workshop