The Current State of SBOMs for End Users

Eddie Zaneski

Hi, I'm Eddie

• Staff Software Engineer @ Defense Unicorns
• Denver, CO
• Maintainer for Kubernetes, protobom, bomctl

Disclaimer

Disclaimer

• I am not an SBOM expert
• Just a dude trying to get things done
• These are hard problems to solve
• There will be opinions and 🔥 hot takes

What Is An SBOM?

SBOMs Are…

​

​

"A list of ingredients that make up software components"

​

​

https://www.cisa.gov/sbom

The SBOM Lifecycle: A Journey to Maturity

​

​

​

​

​

​

​

​

​

​

​

https://www.sans.org/blog/strengthen-your-supply-chain-security-with-effective-sbom-management/

SBOM Type Definition and Composition

​

​

​

​

​

​

​

​

​

​

​

​

https://www.cisa.gov/sites/default/files/2023-04/sbom-types-document-508c.pdf

SBOM Type Definition and Composition

​

​

​

​

​

​

​

​

​

​

​

​

https://www.cisa.gov/sites/default/files/2023-04/sbom-types-document-508c.pdf

Why Should You Care About SBOMs?

Because…

• Regulations
• Executive Order 14028
• FedRAMP
• EU Cyber Resilience Act
• Security
• They let you do cool stuff

Where SBOM Things Started For Me

Where This Started

• 2022 - working at Chainguard
• I have a container image with a fancy SBOM
• I build my app, produce an SBOM
• I layer my app on that base image
• How do I represent what I just made as an SBOM?

https://giphy.com/gifs/charlie-good-luck-boa-sorte-ma7VlDSlty3EA

me: how do i do the thing?

​

puerco: the community is still figuring that out

​

puerco: you can combine them or produce a new one

​

me: which should i do and how

​

puerco: yes

​

me: …

Where Things Are Now

https://zarf.dev

Where Things Are Now

• April 2024
• Produce a vulnerability report for a Zarf package
• Zarf package has 10 bundled containers so we have 10 SBOMs
• Vuln scanning tools don't know what a Zarf package is
• Scan 10 SBOMs and aggregate the results or combine SBOMs

https://giphy.com/gifs/thesimpsons-3o6MblBrdWarJwXLRC

https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf

What's The Current State?

FORMATS

• ~3 of them
• CycloneDX
• SPDX
• SWID Tagging
• Syft
• Focus seems to be on spec completeness
• Stuck in academia and "might need one day" features
• Not on
• End users
• Practical use cases
• Interoperability

Regulations

• Checkboxes
• Can pretty much submit an empty sbom.json file or a hand crafted sbom.docx
• FedRAMP has some new changes coming

Tooling

• Mostly find your own
• There are lists out there…
• Mostly CDX results from Google
• Maven
• Ruby
• Python
• Go
• Syft
• protobom & bomctl

Build Time vs Runtime

"You can generate a Bill of Materials using the source code during build time, during runtime, or while doing forensics on the software. Of all these, experts recommend generating an SBOM during the build time. That’s because build-time SBOM generators are more accurate and generate a more complete list of dependencies…"

https://scribesecurity.com/sbom/how-to-generate-an-sbom/#when-to-generate-a-software-bill-of-materials

What Do I Do With This?

• Stick it in your SBOM folder?
• Mostly proprietary solutions out there. "Book a demo"
• GUAC
• bomctl & protobom/storage

Best Practices

• 🤷

https://giphy.com/gifs/theoffice-gphyoffice726-pAfV2UQgGnrhf0hf5c

Where Do I Want Things To Go?

Guidance

• What are the best practices?
• How do we tie together different SBOMs and layers?
• Reference implementations
• Work backwards from how we want to use these things

My SBOM Future

• A format - CISA PLZ
• Ubiquitous & Boring
• Graph of data
• It's all built-in and automatic
• This includes my build tools
• A focus on practical usage
• Index them on a timeline

Where To Get Involved

• OpenSSF Working Groups
• SBOM Tooling WG
• Security Tooling WG
• Supply Chain Integrity WG
• SBOM Everywhere SIG
• protobom
• Every other Wednesday @ 9am PT
• Spec meetings

Thanks!

Questions?

​

@eddiezane.bsky.social

​

​