SBOMS and supply chains
Enhancing Swift’s Supply Chain Security: Build-time SBOM Generation in Swift Package Manager
February 1, 2026
4:00 PM – 4:30 PM Add to calendar
4:00 PM – 4:30 PM Add to calendar
UD2.208 (Decroly)
<p>A Software Bill of Materials (SBOM) provides a detailed inventory of software components in an artifact. SBOMs allow developers to improve the supply chain security of their Swift projects by analyzing direct and transitive dependencies for vulnerabilities. Currently, Swift Package Manager (SwiftPM) lacks built-in SBOM support, and developers must rely on third-party tools that can under- or over-represent package dependencies in a project, leading to a lack of critical information or too much noise.</p>
<p>This talk focuses on an in-development feature to integrate SBOM generation directly into the Swift toolchain. As a result of this upcoming integration, developers will be able to create industry-standard CycloneDX or SPDX SBOMs as part of their build, without additional configuration. We will delve into the design in which SwiftPM employs the resolved modules graph to generate accurate SBOMs that capture both package and product dependencies, and optionally incorporates SwiftBuild build system’s build graph to align the SBOM with build-time conditions.</p>
<p>Listeners will be introduced to the basics of SwiftPM, learn more about the upcoming SBOM generation design that leverages SwiftPM’s existing graph structures, and have the opportunity to provide feedback before the feature is released.</p>
Additional information
| Live Stream | https://live.fosdem.org/watch/ud2208 |
|---|---|
| Type | devroom |
| Language | English |
More sessions
| 2/1/26 |
<p>Welcome to another year of the SBOM devroom, now also including more general Supply Chain topics!</p> <p>The organizers will introduction the topics and the structure of the devroom.</p>
|
| 2/1/26 |
<p>The growing use of Software Bill of Materials (SBOMs) has introduced a new challenge with six different types exist (Design, Source, Build, Analysed, Deployed, and Runtime). As each type captures component information at a unique point in the development lifecycle, it is no longer sufficient to say that you want an SBOM' you need the right one which meets your use case. So how do you determine which SBOM type is the right fit for your specific use case?</p> <p>This session attempts to provide ...
|
| 2/1/26 |
<p>Modern embedded products are no longer single-processor devices. A typical architecture combines a Linux-based main system, one or more microcontrollers running RTOS workloads, and cloud-side processing also running on Linux. Each of these components produces its own SBOM - often using different formats, tooling, and levels of detail.</p> <p>But what happens when you need to use all of them together for vulnerability management?</p> <p>This talk shares a real-world journey of attempting to ...
|
| 2/1/26 |
<p>Various tools producing SBOMs for pre-built artifacts, such as container images, usually provide only a flat list of components - packages, libraries, RPMs, and binaries - without explaining where any of them originated. But why does this origin information matter, and how can we obtain it?</p> <p>To simply introduce the concept, imagine your build ecosystem as a bakery: the built container is the loaf of bread, and your SBOM is the ingredient label on the package. While customers only see a ...
|
| 2/1/26 |
<p>When a new CVE surfaces in an open-source dependency, teams face an immediate question: Do we really need to update? Is the vulnerability <strong>eploitable</strong>? In practice, nearly 90% of reported issues never affect the consuming application, but identifying the critical 10% is far from trivial. Reachability analysis offers a path forward by tracing vulnerable functions from the upstream component through multi-hop call graphs to determine whether the affected code is ever invoked ...
|
| 2/1/26 |
<p>The modern software supply chain is no longer suffering from a lack of data. Between SBOMs, SLSA provenance, and vulnerability scans, DevOps teams are drowning in attestations. However, a critical gap remains: the ability to aggregate this diverse evidence and enforce consistent, automated security decisions. Simply having an SBOM does not secure your pipeline; verifying its content against a trusted policy does.</p> <p>In this talk, we introduce <strong>Conforma</strong>, an open-source tool ...
|
| 2/1/26 |
<p>As one of the co-leaders of the CISA working group on <a href="https://github.com/SBOM-Community/SBOM-Generation">SBOM Generation</a> and a contributor to its accompanying <a href="https://github.com/SBOM-Community/SBOM-Generation/blob/main/whitepaper/Draft-SBOM-Generation-White-Paper-Feb-25-2025.pdf">whitepaper</a>, I’ve spent the last few years deep in the trenches of SBOM creation. With the EU’s Cyber Resilience Act (CRA) raising the bar for software transparency and lifecycle ...
|
