SBOMS and supply chains
Beyond SBOM: Integrating VEX into Open Source Workflows
February 1, 2026
10:30 AM – 11:00 AM Add to calendar
10:30 AM – 11:00 AM Add to calendar
UD2.208 (Decroly)
<p>When a new CVE surfaces in an open-source dependency, teams face an immediate question: Do we really need to update? Is the vulnerability <strong>eploitable</strong>? In practice, nearly 90% of reported issues never affect the consuming application, but identifying the critical 10% is far from trivial. Reachability analysis offers a path forward by tracing vulnerable functions from the upstream component through multi-hop call graphs to determine whether the affected code is ever invoked downstream.</p>
<p>Despite its value, reachability analysis is notoriously difficult to automate. Most organizations still rely on manual investigation, while existing SCA tools frequently fall short, leaving teams uncertain and prompting unnecessary upgrades.</p>
<p>This talk presents a concrete case study from Apache Hadoop and Solr, illustrating how accurate reachability analysis can prevent wasted effort, reduce noise, and focus attention on the vulnerabilities that truly matter. The reachability of vulnerabilities will be analyzed using the Open Source VEX Generation Toolset project.</p>
Additional information
| Live Stream | https://live.fosdem.org/watch/ud2208 |
|---|---|
| Type | devroom |
| Language | English |
More sessions
| 2/1/26 |
<p>Welcome to another year of the SBOM devroom, now also including more general Supply Chain topics!</p> <p>The organizers will introduction the topics and the structure of the devroom.</p>
|
| 2/1/26 |
<p>The growing use of Software Bill of Materials (SBOMs) has introduced a new challenge with six different types exist (Design, Source, Build, Analysed, Deployed, and Runtime). As each type captures component information at a unique point in the development lifecycle, it is no longer sufficient to say that you want an SBOM' you need the right one which meets your use case. So how do you determine which SBOM type is the right fit for your specific use case?</p> <p>This session attempts to provide ...
|
| 2/1/26 |
<p>Modern embedded products are no longer single-processor devices. A typical architecture combines a Linux-based main system, one or more microcontrollers running RTOS workloads, and cloud-side processing also running on Linux. Each of these components produces its own SBOM - often using different formats, tooling, and levels of detail.</p> <p>But what happens when you need to use all of them together for vulnerability management?</p> <p>This talk shares a real-world journey of attempting to ...
|
| 2/1/26 |
<p>Various tools producing SBOMs for pre-built artifacts, such as container images, usually provide only a flat list of components - packages, libraries, RPMs, and binaries - without explaining where any of them originated. But why does this origin information matter, and how can we obtain it?</p> <p>To simply introduce the concept, imagine your build ecosystem as a bakery: the built container is the loaf of bread, and your SBOM is the ingredient label on the package. While customers only see a ...
|
| 2/1/26 |
<p>The modern software supply chain is no longer suffering from a lack of data. Between SBOMs, SLSA provenance, and vulnerability scans, DevOps teams are drowning in attestations. However, a critical gap remains: the ability to aggregate this diverse evidence and enforce consistent, automated security decisions. Simply having an SBOM does not secure your pipeline; verifying its content against a trusted policy does.</p> <p>In this talk, we introduce <strong>Conforma</strong>, an open-source tool ...
|
| 2/1/26 |
<p>As one of the co-leaders of the CISA working group on <a href="https://github.com/SBOM-Community/SBOM-Generation">SBOM Generation</a> and a contributor to its accompanying <a href="https://github.com/SBOM-Community/SBOM-Generation/blob/main/whitepaper/Draft-SBOM-Generation-White-Paper-Feb-25-2025.pdf">whitepaper</a>, I’ve spent the last few years deep in the trenches of SBOM creation. With the EU’s Cyber Resilience Act (CRA) raising the bar for software transparency and lifecycle ...
|
| 2/1/26 |
<p>500,000 SBOMs -- that's the scale of Deutsche Bahn's software supply chain. We will show how we extend our automated collection of Source, Build, Artifact, and Runtime SBOMs from both internal systems and external suppliers, and how we make this data usable. Doing this, we understand that SBOMs are not a tool by themselves but a supporting method for various use-cases. To facilitate them, we heavily rely on FOSS tools, enriched with own logic to fit into our enterprise architecture. You love ...
|
