An SBOM Primer: From Licenses to Security, Know What’s in Your Code, or Someone Else’s!
summary
Minimum SBOM here is concrete: a 38-line NTIA-conformant file with supplier, component name, version, unique IDs (PackageURL/CPE/CVE), dependency relationships and creation timestamp. An example spdx-json document is hand‑written, validated on tools.spdx.org and passes the NTIA conformance checker. Adding checksum, download location and declared/concluded license increases fidelity. Build-time generators and scanners (Maven/Gradle plugins, ORT, Sif, snippet scanners) produce SBOMs; running spdx-to-osv against one SBOM surfaces real CVE hits.
AI-written summary · about
chapters (15)
- 0:00SBOM introduction
- 1:50What is an SBOM
- 4:00SBOM standard formats
- 5:24SBOM minimum requirements
- 8:54Minimal SBOM demo
- 14:32When to use SBOMs
- 18:28SBOM tooling
- 24:49SBOM source files
- 26:38SBOM dependency tracking
- 28:47SBOM for security
- 30:54SBOM license compliance
- 34:51SBOM tips
- 35:14SBOM future standards
- 36:17Next steps
- 37:42Q&A
related talks
27mSBOM: The Rest Of the Story
52mThe World on SBOMs
16mKeynote: SBOM is Coming: Why You Should Care and How You Can Help
45mSmarter Than Your Average SBOM!- 45mSmarter Than Your Average SBOM!
38mSBOM Implementation Reality - the SPDX Lite Profile for First Step
40mDBOM and SBOM: New Options For Better Supply Chain Cybersecurity
22mSBOM and Security Transparency - How it all fits together