fosdem-2025-sbom_opt.jpg

In the context of a Linux software factory dedicated to building embedded software, we will discuss the choices and challenges we encountered in integrating SBOM file generation into a software supply chain involving many packages.

<br>

The talk will begin with a brief overview of the various formats (SPDX, CycloneDX, ...), tools and ecosystems surrounding SBOM, highlighting the essential knowledge required to integrate these features into a supply chain. Then, this presentation will address the challenges we faced in retrieving accurate and reliable information to generate various BOMs: How do we ensure the data is correct and up-to-date? What are the common pitfalls in data collection? Which format best suits your needs, and what are the trade-offs between different solutions? Finally, we will explore the importance of having SBOMs and the necessity of tracing and signing each element in the supply chain to ensure integrity (focusing here on SLSA).

<br>

- [Watch talk's video](https://ftp.fau.de/fosdem/2025/h2213/fosdem-2025-5784-lessons-learned-from-integrating-sbom-in-a-supply-chain.av1.webm)
- [SBOM-SebD-Fosdem-02-2025.pdf](https://iot.bzh/download/public/2025/SBOM-SebD-Fosdem-02-2025.pdf)
- [FOSDEM 2025 schedule event](https://fosdem.org/2025/schedule/event/fosdem-2025-5784-lessons-learned-from-integrating-sbom-in-a-supply-chain/)

<br>

![fosdem-2025-sbom_opt.jpg](/images/uploads/articles/fosdem_2025_sbom_opt_822c55a14d.jpg)


large_FOSDEM_logo.svg.png

SBOM/CVE/SLSA Publications

Lessons learned from integrating SBOM in a supply chain

Cookie policy