3 ms·
I like the idea of having an SBOM as a standard, baked-in feature from the outset. That kind of thing is becoming critical in software supply chain management.
by rcarmo 3y ago
I like the idea of having an SBOM as a standard, baked-in feature from the outset. That kind of thing is becoming critical in software supply chain management.
- dlor 3y agoThanks! By building the SBOMs as part of the build process we can ensure full coverage, vs. the other approaches that rely on "guessing" the contents after. We wrote a bit more about this approach here: https://www.chainguard.dev/unchained/make-sboms-not-guessboms-why-we-need-to-shift-left-on-sbom-generation https://www.chainguard.dev/unchained/make-sboms-not-guessbom...
- schemescape 3y agoIf nothing else, it's at least useful to ensure you are able to comply with all the open source license terms. Now how many copies of the MIT and BSD licenses do I need to include with my software? ;)