Realities of SBOM: What Is Under the Hood of SBOM?
summary
SBOMs are not static files but a dynamic, per-build artifact tracked across code, build and runtime phases; the demo shows cargo generating CycloneDX/SPDX output inside GitLab CI/CD and a GitLab Runner, automatic BOM scanning for CVEs, verification with in-toto attestation, and storage in an artifact catalog. Real costs surface: one small org spends ~$900k to hunt Log4j and a compromise estimate reaches $5.7M. Practical rules: generate SBOMs in CI, capture build/runtime manifests, enforce policy in pipelines, and integrate dependency scanning and governance.
AI-written summary · about
chapters (21)
- 0:00Introduction
- 2:11Software complexity evolution
- 4:00Why SBOM matters
- 8:15Trust in dependencies
- 10:43Hidden dependency complexity
- 13:11Actionable SBOM files
- 15:35SBOM and DevSecOps
- 18:27SBOM in development lifecycle
- 21:14SBOM file elements
- 24:04Automating SBOM with CI/CD
- 25:51SBOM policy governance
- 28:58Comparing SBOM formats
- 29:59Protecting SBOM files
- 31:42Secure infrastructure with SBOM
- 35:17Proactive security with SBOM
- 36:23Live demo: SBOM generation
- 44:18Validating SBOM in pipelines
- 45:44SBOM across lifecycle
- 47:11Automation takeaways
- 48:54SBOM adoption resources
- 49:36Q&A
related talks
46mSBOMs Are Not Enough
38mThe State of SBOMs
45mSmarter Than Your Average SBOM!
27mSBOM: The Rest Of the Story
41mYour SBOM Is Lying To You – Let’s Make It Honest
01h 26mPractical Software Bill of Materials: From Generation to Distribution Workshop- 45mSmarter Than Your Average SBOM!
22mBuilding a Robust SBOM Solution with Backstage.io