SBOMS and supply chains
The day in a life of a SBOM
<p>The growing use of Software Bill of Materials (SBOMs) has introduced a new challenge with six different types exist (Design, Source, Build, Analysed, Deployed, and Runtime). As each type captures component information at a unique point in the development lifecycle, it is no longer sufficient to say that you want an SBOM' you need the right one which meets your use case. So how do you determine which SBOM type is the right fit for your specific use case?</p>
<p>This session attempts to provide the answer through the use of the creation of a sample application moving through the entire development pipeline, demonstrating precisely how the SBOM's content evolves from an initial Design SBOM to a final Runtime SBOM captured within a runtime environment. It will demonstrate the critical information that can be gained at each stage, the specific use cases that each SBOM type enables, and the practical challenges that still need to be overcome to create reliable, high-quality SBOMs.</p>
Additional information
| Live Stream | https://live.fosdem.org/watch/ud2208 |
|---|---|
| Type | devroom |
| Language | English |
More sessions
| 2/1/26 |
<p>Welcome to another year of the SBOM devroom, now also including more general Supply Chain topics!</p> <p>The organizers will introduction the topics and the structure of the devroom.</p>
|
| 2/1/26 |
<p>Modern embedded products are no longer single-processor devices. A typical architecture combines a Linux-based main system, one or more microcontrollers running RTOS workloads, and cloud-side processing also running on Linux. Each of these components produces its own SBOM - often using different formats, tooling, and levels of detail.</p> <p>But what happens when you need to use all of them together for vulnerability management?</p> <p>This talk shares a real-world journey of attempting to ...
|
| 2/1/26 |
<p>Various tools producing SBOMs for pre-built artifacts, such as container images, usually provide only a flat list of components - packages, libraries, RPMs, and binaries - without explaining where any of them originated. But why does this origin information matter, and how can we obtain it?</p> <p>To simply introduce the concept, imagine your build ecosystem as a bakery: the built container is the loaf of bread, and your SBOM is the ingredient label on the package. While customers only see a ...
|
| 2/1/26 |
<p>When a new CVE surfaces in an open-source dependency, teams face an immediate question: Do we really need to update? Is the vulnerability <strong>eploitable</strong>? In practice, nearly 90% of reported issues never affect the consuming application, but identifying the critical 10% is far from trivial. Reachability analysis offers a path forward by tracing vulnerable functions from the upstream component through multi-hop call graphs to determine whether the affected code is ever invoked ...
|
| 2/1/26 |
<p>The modern software supply chain is no longer suffering from a lack of data. Between SBOMs, SLSA provenance, and vulnerability scans, DevOps teams are drowning in attestations. However, a critical gap remains: the ability to aggregate this diverse evidence and enforce consistent, automated security decisions. Simply having an SBOM does not secure your pipeline; verifying its content against a trusted policy does.</p> <p>In this talk, we introduce <strong>Conforma</strong>, an open-source tool ...
|
| 2/1/26 |
<p>As one of the co-leaders of the CISA working group on <a href="https://github.com/SBOM-Community/SBOM-Generation">SBOM Generation</a> and a contributor to its accompanying <a href="https://github.com/SBOM-Community/SBOM-Generation/blob/main/whitepaper/Draft-SBOM-Generation-White-Paper-Feb-25-2025.pdf">whitepaper</a>, I’ve spent the last few years deep in the trenches of SBOM creation. With the EU’s Cyber Resilience Act (CRA) raising the bar for software transparency and lifecycle ...
|
| 2/1/26 |
<p>500,000 SBOMs -- that's the scale of Deutsche Bahn's software supply chain. We will show how we extend our automated collection of Source, Build, Artifact, and Runtime SBOMs from both internal systems and external suppliers, and how we make this data usable. Doing this, we understand that SBOMs are not a tool by themselves but a supporting method for various use-cases. To facilitate them, we heavily rely on FOSS tools, enriched with own logic to fit into our enterprise architecture. You love ...
|
