Posts

In our previous posts, we streamlined SBOM workflows by moving them from GitHub releases or local folders directly into platforms like Dependency-Track and then, we took it one step further with folder continuous monitoring—continuous fetching and uploading via sbommv’s daemon mode, which runs in the background and keeps an eye on target folders for any incoming or modified SBOMs. As we know, sbommv is a modular system that seamlessly integrates multiple input systems like folders, GitHub, and multiple output systems like Dependency-Track, Interlynk, and folders—allowing SBOMs to move effortlessly from one system to another. Building on that foundation, it’s time for another leap forward: Integrating AWS S3 with sbommv. ...

Hey there 👋 SBOM practitioners, compliance engineers, and open-source watchers! If you’ve been working with SBOMs lately—whether you’re producing them or consuming them—you’ve probably noticed how quickly they’ve gone from “nice to have” to absolutely essential. I hope now your getting comfortable on working with SBOMs and familiar with software supply chain security terminologies. We all are well-known about the wake-up call on SBOMs, First one was SolarWinds attack(and later on log4j attack) and US Executive Order 14028 by Biden Govt. And since then, the communities started stepping into this complex world wired with complex software( in form of dependencies) to secure software supply chain security from software supply chain attacks. Next step towards it taken by big organization like OpenSSF and countries by showing up their interest towards it, which resulted into various SBOM guidelines, SBOM related tools, SBOM compliances, SBOM platforms, SCA tools, etc were born. ...

Introduction In our previous post(GitHub Releases are where SBOM’s goto die), we tackled a growing pain in modern software security: SBOMs stuck in GitHub Releases. We showed how sbommv streamlines the manual mess—automating the movement of SBOMs from GitHub or local folders directly into SBOM platforms like Dependency-Track, Interlynk(next blog will show demo on this). We covered: 🔄 Pulling SBOMs straight from GitHub via API or releases 🧳 Uploading pre-existing SBOMs from local folders 🔍 Using dry-run mode to validate before uploading And transferring those fetched SBOMs to dependency-track platform smoothly and seamlessly. That was the start. But it still required you to trigger the command each time, especially when input adapter or input system(source of SBOMs) is folder. ...

Hey there 👋, SBOM enthusiasts ! Since the 2021 Cyber security Executive Order by Joe Biden. SBOMs (Software Bill of Materials) have become essential for software security and compliance. With countries like the EU, US, Germany, and India introducing their own SBOM regulations, it’s clear: SBOMs aren’t optional anymore—they’re the new standard. To meet this demand, tools for SBOM generation, signing, quality analysis, enrichment, and integration into security platforms have rapidly evolved, largely driven by the open-source community. ...

Introduction In today’s interconnected software ecosystem, applications are rarely built from scratch. Modern software is assembled from hundreds or even thousands of components - open source libraries, proprietary modules, and third-party services. This complexity creates a critical challenge: how do we know what’s actually inside our software? Enter the Software Bill of Materials (SBOM) - a comprehensive inventory that provides transparency into software components and their relationships. What is an SBOM? A Software Bill of Materials (SBOM) is a formal, machine-readable inventory of all components, libraries, and modules that make up a software application. Think of it as a detailed ingredient list for software - just as food products list their ingredients and nutritional information, an SBOM lists all the software components and their dependencies. ...