3 ms·

I always thought SBoMs _can_ link to all the dependencies a build used, which user can later securely resolve to all the transitive binaries/dependencies like l

I always thought SBoMs _can_ link to all the dependencies a build used, which user can later securely resolve to all the transitive binaries/dependencies like log4j version a.b.c.

tadfisher 3y ago
In the SolarWinds case, the attack was carried out on the build system itself, so a hypothetical SBoM published by the compromised build system itself would be fairly useless to their customers.