SBOM Automation - Making Compliance Effortless by Consuming, Enrichin...
summary
Demonstrates an automated SBOM pipeline that consumes CycloneDX/SPDX SBOMs, enriches them and pushes results into SW360 while using ORT (OSS Review Toolkit) for analysis; demo imports 1,326 packages and creates 741 releases in 42 seconds. Introduces a package portlet that maps package URLs to VCS repositories so multiple binary packages tied to one repo collapse 31 clearance reports into a single source clearing, focusing on license clearing now and noting future vulnerability DB integrations.
AI-written summary · about
chapters (9)
- 0:00Introduction and challenges
- 1:25Software dependency issues
- 4:42Introduction to software 360
- 7:25Version updates and demo
- 11:11Automated management benefits
- 16:07Siemens compliance workflow
- 21:09Package portlet architecture
- 27:00Practical workflow demonstration
- 35:12Conclusion and Q&A
related talks
42mThe SBOM Way! The Art of Consuming, Enriching, and Managing Inbound..- 42mThe SBOM Way! The Art of Consuming, Enriching, and Managing Inbound..
43mSBOM Management with SW360: Cross-Industry Perspectives and Best Practices
26mLeveraging SBOMS to Automate Packaging, Transfer, and Reporting of D...
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
57mSBOMs in the Real World: Practical Guidance for Managing Three Common SBOM Scenarios
22mBuilding a Robust SBOM Solution with Backstage.io
34mSBOM Quality: We Need More Than a Simple “SBOM Button” for Compliance