The State of SBOMs
summary
Cloud-native projects now produce SBOMs at build time and Kubernetes ships SBOMs in a recent release, using standards like CycloneDX and SPDX and tools such as Tern to enumerate components. SBOMs turn out to be very large — hundreds to thousands of transitive components per image — and identity resolution and content fingerprinting remain unsolved. Work that exists is: SBOM creators at build, distro reproducible-build techniques, and a gap in analytic tooling to filter, map to CVEs/licenses, and verify compiler/environment provenance.
AI-written summary · about
chapters (8)
- 0:00Start
- 0:20Alan Friedman
- 3:43Dan Lawrence
- 4:03Favorite Metaphors for S-Bombs
- 6:11Difference in Quality between the Subway Sandwich and a Sandwich That Was Created by a Farm to Table Restaurant
- 19:19Challenge with Cloud Native
- 27:11Software Identity
- 30:53Build Systems
related talks
46mSBOMs Are Not Enough
27mSBOM: The Rest Of the Story
36mSBOMs, VEX, and Kubernetes
16mKeynote: SBOM is Coming: Why You Should Care and How You Can Help
34mSo, SBOMs Matter…Now What?
35mTransforming SBOMs from Compliance Burden to Security Asset
29mThe Current State of SBOMs for End Users
28mLeverage Kubernetes SPDX Tools to Create Your SBOM