https://peertube.watch/videos/watch/b829b997-73a4-419f-8061-6bd2a6bfa3f8 The Software Bill of Materials (SBOM) has frequently been cited as a crucial component in securing the software supply chain. Its value proposition is the ability to answer critical questions such as, "Am I vulnerable to CVE-XYZ?". In theory, SBOM should simplify risk assessment by prioritizing the remediation of vulnerable applications. However, when considering the software supply chain as a whole and the myriad potential threat vectors (https://slsa.dev/spec/v1.0/threats), it's clear that SBOM provides limited utility when securing end-2-end software delivery from producer to consumer. How is an SBOM produced? How is it delivered? Does it bundle the artifacts it describes? Can you verify the provenance of the SBOM? These questions lead us to ask whether the SBOM has any real utility as a standalone entity. In this session, we shall introduce the Open Component Model (OCM, https://ocm.software), an open standard and tooling that supports establishing a secure software supply chain, from producer to consumer. OCM's dedicated tooling packages security and compliance-relevant metadata, such as SBOMs, alongside the software artifacts. It includes support for signing operations, as well as secure transport of artifacts ensuring their integrity and provenance. Our session is ideal for those who find these questions intriguing and are eager to explore possible answers! Speaker: Vasu Chandrasekhara, Track: Software Bill of Materials devroom, Room: K.4.401, When: Sunday 4 February 2024, 10:30–10:45 (Brussels time), Schedule: FOSDEM 2024 event page, Slides & links Presentation Slides, Github Org of OCM project, OCM project web page, Licence: Creative Commons Attribution 2.0 Belgium (CC BY 2.0 BE) (as stated in the FOSDEM video archive). Attribution: “SBOM: What's next?” by Vasu Chandrasekhara, FOSDEM 2024. Original recording: 2024/k4401/fosdem-2024-2939-sbom-what-s-next-.av1.webm from the FOSDEM video archive. This channel is an unofficial mirror; FOSDEM is a free and non-commercial event organised by the community for the community. Sun, 25 Oct 2026 01:56:59 GMT https://validator.w3.org/feed/docs/rss2.html PeerTube - https://peertube.watch https://peertube.watch/lazy-static/avatars/3b284627-b75f-409e-ac2e-10f4c2946f43.png https://peertube.watch/videos/watch/b829b997-73a4-419f-8061-6bd2a6bfa3f8 All rights reserved, unless otherwise specified in the terms specified at https://peertube.watch/about and potential licenses granted by each content's rightholder.