Elephant in the Room: How Supply Chain Security Standards Are Not St...
summary
Claims that SBOM formats are not true standards and the core interoperability break is package identity, not just competing formats. Evidence: CycloneDX outputs from Sift and Trivy omit key fields like licenses and dependencies, PURLs often lack versions, and NVD/CPEs are cryptic. Proposals: a shared package identity parser spec, aliases and fuzzy matching to avoid bespoke logic, more build‑time SBOMs, and scorecards that validate quality not mere presence.
AI-written summary · about
chapters (9)
- 0:00SBOM challenges introduction
- 1:03SBOM format problems
- 2:31Package identity issues
- 3:58Fuzzy matching in SBOMs
- 5:00Build-time SBOM needs
- 6:06CycloneDX vs SPDX
- 7:30Software identity problems
- 9:16Pearl format issues
- 10:43Version and name inconsistencies
related talks
45mWhat’s in a Name? Vulnerabilities, SBOMs, and the Challenge of Software Identity
14mKeynote: The Next Steps in Software Supply Chain Security
27mSBOM: The Rest Of the Story
37mSecuring OSS across the whole supply chain and beyond
22mSBOM and Security Transparency - How it all fits together
45mSmarter Than Your Average SBOM!
40mDBOM and SBOM: New Options For Better Supply Chain Cybersecurity
16mKeynote: SBOM is Coming: Why You Should Care and How You Can Help