4 ms·
That's fine if you're running on a Linux platform, but if you're running on AWS/GCP/Azure with lambdas/workers/serverless, you need to have the SBOM for your ow
by rswail 5y ago
That's fine if you're running on a Linux platform, but if you're running on AWS/GCP/Azure with lambdas/workers/serverless, you need to have the SBOM for your own software.
Not everything is going to be accepted as part of Debian as a distribution.
- pabs3 5y agoIf you are using a proprietary cloud platform there can be no real SBOM, because you're relying on software you can't even get a hash of. The SBOM for the part of the software that you do control when running on such platformas has to be something that the proprietary platform supports, which obviously will have zero overlap with Debian packaging, so in that situation you just need to look at what the platform supports. For situations where one is using Debian but also software not in Debian, you can create an internal apt repository and make internal .deb packages to put in the internal apt repository.