Do You Know What's in the Software You Run? Introducing GitBOM
summary
GitBOM is a minimal build-time scheme that records every input file used to produce each artifact by generating an artifact dependency graph and computing canonical IDs for each artifact. It creates gitoid (sha1+sha256) values for each artifact, persists them in .bomb objects, and embeds into ELF .bomb / tar entry / Java annotation / image manifest. Prototypes exist for LLVM, Go, Rust and bash; GitBOM is included in SPDX 2.3 and a gitoid URI is provisionally accepted by IANA.
AI-written summary · about
chapters (12)
- 0:00Nell Shamrell- Harrington
- 2:13Evidence
- 3:19What is GitBOM not?
- 4:07What is GitBOM?
- 5:40Build Tool
- 8:10Artifact Dependency Graph
- 10:48How does Git create an object id?
- 11:27Git Object ID
- 12:44SHA-1?
- 13:43What does GitBOM do?
- 15:39GitBOM Document(s)
- 16:26Embedded Gitoid Ideas
related talks
43mGitBOM: Repurposing Git’s Graph for Supply Chain Security & Transparency
35mRepurposed Purpose: Using git's DAG for Supply Chain Artifact Resolution
11mLightning Talk: Repurposed Purpose: Using Git's DAG for Supply Chain Artifact Resolution
41mOmniBOR: Bringing the Receipts for Supply Chain Security
38mTeach Your SBOM New Tricks with Bomshell
50mRealities of SBOM: What Is Under the Hood of SBOM?
37mSBOMs Aren't Enough. Secure Your Software Supply Chain End-To-End
39mSecure Your Supply Chain: Adding a Software Bill of Materials to Your Containers to Improve...