Uploaded August 2026 | Updated September 2026, 3 weeks ago
Don't miss out! Join us at our next KubeCon + CloudNativeCon events in Shanghai, China (8-9 September, 2026) and Salt Lake City, United States (Nov 9–12, 2026). Connect with our current graduated, incubating, and sandbox projects as the community gathers to further the education and advancement of cloud native computing. Learn more at kubecon.io
SBOMit: Making SBOMs Accurate With Attestations - Marco De Vincenzi & Justin Cappos, NYU
Software Bill of Materials (SBOM) adoption is accelerating, driven by regulatory mandates and high-profile supply chain incidents. However, a critical and underappreciated problem persists: SBOMs can be inaccurate. Traditional SBOM generation tools rely on static analysis or package manifests, approaches that routinely miss dynamically downloaded dependencies, build-time artifacts, and network-fetched components.
This talk introduces SBOMit, an OpenSSF project, a supply-chain security framework that solves the accuracy problem by generating SBOMs from in-toto attestations captured at build time. Rather than inferring what was used, SBOMit observes and records it, leveraging the witness tool to trace filesystem reads and writes, process execution, and outbound network connections during the actual build. Every dependency encountered during the build is captured and cryptographically authenticated. The resulting SBOM is not a best guess; it is a verified record of what was built.
Don't miss out! Join us at our next KubeCon + CloudNativeCon events in Shanghai, China (8-9 September, 2026) and Salt Lake City, United States (Nov 9–12, 2026). Connect with our current graduated, incubating, and sandbox projects as the community gathers to further the education and advancement of cloud native computing. Learn more at kubecon.io
SBOMit: Making SBOMs Accurate With Attestations - Marco De Vincenzi & Justin Cappos, NYU
Software Bill of Materials (SBOM) adoption is accelerating, driven by regulatory mandates and high-profile supply chain incidents. However, a critical and underappreciated problem persists: SBOMs can be inaccurate. Traditional SBOM generation tools rely on static analysis or package manifests, approaches that routinely miss dynamically downloaded dependencies, build-time artifacts, and network-fetched components.
This talk introduces SBOMit, an OpenSSF project, a supply-chain security framework that solves the accuracy problem by generating SBOMs from in-toto attestations captured at build time. Rather than inferring what was used, SBOMit observes and records it, leveraging the witness tool to trace filesystem reads and writes, process execution, and outbound network connections during the actual build. Every dependency encountered during the build is captured and cryptographically authenticated. The resulting SBOM is not a best guess; it is a verified record of what was built.
