Talk
IndiaFOSS 2024
Demystifying SBOMs: A Deep Dive into Software Bill of Materials for FOSS Management
Session Description
This talk aims to provide a comprehensive overview of Software Bill of Materials (SBOMs) within the Free and Open Source Software (FOSS) domain. It will trace the evolution of SBOMs and highlight their growing importance in security and artifact management. Key topics to be covered include:
- Introduction: SBOMs and Their Benefits
- Evolution of SBOMs: From traditional BOMs to SBOMs, SaaSBOMs, ML(Machine Learning)BOMs, C(Cryptography)BOMs, etc.
- Industry Standards for Creating SBOMs: A look at SPDX and CycloneDX.
- Comparative Analysis: Evaluating SBOMs generated by different tools.
- Advancements in SBOMs: Including VEX and EPSS.
- Existing and upcoming Industry regulations
- Future Trends and Developments
This session will equip developers and managers with an understanding of the critical role SBOMs play in the development cycle. It will emphasize the importance of documenting third-party open source dependencies and transitive dependencies to identify security and licensing issues, both for current projects and for future scenarios where new vulnerabilities might arise.