Session
FOSDEM Schedule 2021
Software Composition

Evolving vulnerabilities in CycloneDX

D.composition
Gareth Rushgrove
<p>CycloneDX is a software bill of materials (SBOM) standard designed for use in application security contexts and supply chain component analysis. It's developed in the open and widely implemented in open source tooling. As well as quick introduction to CycloneDX, this talk will look in particular at the vulnerability extension.</p> <p>Modelling vulnerabilities in software is surprisingly complex. In this talk we'll look at some of the current issues in the CycloneDX vulnerability extension, summarise some of the ongoing discussions in this area, and get people's input on proposals for improvements.</p>

No prior knowledge of CycloneDX will be required for this session. The basics of the specification are simple enough for folks interested in Software Composition Analysis to grok quickly. The main aim of the session is to raise awareness of the open specification and the process around it, and get more eyes on future improvements. The audience should come away with some insight into why CycloneDX is useful, why open standards are important and how to get involved in the project.

Additional information

Type devroom

More sessions

2/7/21
Software Composition
Philippe Ombredanne
D.composition
<p>Welcome to the Software Composition Analysis Devroom</p>
2/7/21
Software Composition
Thomas Steenbergen
D.composition
<p>In this session we will provide an update on OSS Review Toolkit (ORT) - which features have been recently added and what they ORT team is currently working on.</p>
2/7/21
Software Composition
Philippe Ombredanne
D.composition
<p>This is a presentation of the latest features and updates in ScanCode toolkit.</p>
2/7/21
Software Composition
D.composition
<p>FOSSology focusses on license compliance analyses. Recently, a number of new features have been published by the community to integrate better with software composition analysis. The presentation shows an introduction of the main and relevant development here.</p>
2/7/21
Software Composition
Remco de Vries
D.composition
<p>Software Composition Analysis (SCA) tools perform source-code analysis, comparison and identification of Open Source components. Sadly, none of the SCA vendors have embraced Open Source themselves, most of their tooling consists of proprietary code and their OSS Knowledge Bases are also closed.</p>
2/7/21
Software Composition
Philippe Ombredanne
D.composition
<p>Container and VM images contain many packages and are quite a challenge for composition analysis.</p>
2/7/21
Software Composition
D.composition
<p>The very short time is some placeholder between presentation groups to have questions being asked and answered or just simple to have a break.</p>