# software bill of materials Published articles for software bill of materials. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Super SBOMs: See exactly what's inside DevFeed: [Super SBOMs: See exactly what's inside]() Original publisher: [Read original article]() Published: 2026-01-29T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard containers](), [Containers](), [chainguard](), [Security](), [spdx]() Tags: [chainguard-containers](), [chainguard-sboms](), [containers](), [cyclonedx](), [fedramp](), [sbom](), [sboms](), [security](), [software-bill-of-materials](), [software-supply-chain-security](), [spdx](), [vulnerability]() ### AI overview Chainguard Containers now provide richer SBOMs with binary-level details about embedded libraries and dependencies, along with CycloneDX support in addition to SPDX. The added visibility helps teams trace vulnerabilities and assess license compliance. ### Source excerpt Chainguard Containers ship richer SBOMs with binary-level library details plus new CycloneDX support, making CVE impact and compliance tracing fast and clear. ## Creating SBOMs with the Snyk CLI DevFeed: [Creating SBOMs with the Snyk CLI]() Original publisher: [Read original article]() Author: Brian Vermeer Published: 2025-02-05T06:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [open-source-security](), [Security](), [Command-line interface](), [Vulnerabilities](), [Software](), [DevOps]() Tags: [2025](), [acquisition](), [application-security](), [blog](), [cli](), [compliance](), [developer](), [devops](), [devrel](), [java](), [open-source-security](), [sbom](), [sboms](), [security](), [snyk-open-source](), [snyk-platform](), [software-bill-of-materials](), [vulnerabilities]() ### AI overview This article explains software bills of materials (SBOMs), their importance for open source security and compliance, and how the Snyk CLI can help create them. It describes SBOMs as inventories of software components, dependencies, versions, and licensing information, and explains how they help assess vulnerability exposure. ### Source excerpt In this post, we'll delve into what SBOMs are, why they're necessary, and their role in open source security. ## Chainguard Images are the Gold Standard for PCI DSS v4.0 DevFeed: [Chainguard Images are the Gold Standard for PCI DSS v4.0]() Original publisher: [Read original article]() Published: 2025-02-03T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [container-security](), [Containers](), [supply-chain-security](), [vulnerability management]() Tags: [chainguard](), [chainguard-images](), [chainguard-sboms](), [compliance](), [container](), [container-image](), [container-image-compliance](), [container-images](), [container-security](), [containers](), [cryptography](), [financial](), [pci-dss](), [pci-dss-v4-0](), [sboms](), [software-bill-of-materials](), [software-composition-analysis](), [software-supply-chain](), [stig](), [vulnerability](), [vulnerability-management]() ### AI overview The article explains how Chainguard Images can support selected PCI DSS v4.0 container-security controls. It focuses on asset and vulnerability management, hardened images, FIPS cryptography, build-time SBOMs, software supply chain inventory, and continuously updated containers. ### Source excerpt Chainguard Images are designed to make container image compliance for PCI DSS v4.0 easy for any company involved in card transactions. ## Software Bill of Materials (SBOM) for your Spin Apps DevFeed: [Software Bill of Materials (SBOM) for your Spin Apps]() Original publisher: [Read original article]() Author: Thorsten Hans Published: 2025-01-16T12:00:00Z Content type: tutorial Language: en Sources: [Fermyon - Experience the next wave of cloud computing.]() Topics: [software bill of materials](), [supply-chain-security](), [trivy](), [Open Source](), [Requirements](), [Software]() Tags: [open-source](), [regulatory](), [sbom](), [software-bill-of-materials](), [software-supply-chain](), [supply-chain](), [trivy]() ### AI overview A tutorial on creating Software Bills of Materials for Spin apps, addressing regulatory requirements and software supply chain security with open-source tools such as Trivy. ### Source excerpt Learn how to create SBOMs for Spin apps, meet regulatory requirements, and secure your software supply chain with open-source tools like Trivy ## Get Smart in 5 Minutes: Vulnerability remediation unveiled DevFeed: [Get Smart in 5 Minutes: Vulnerability remediation unveiled]() Original publisher: [Read original article]() Published: 2024-08-16T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Vulnerabilities](), [software bill of materials](), [Security](), [Software]() Tags: [developer](), [sbom](), [scanners](), [security](), [software-bill-of-materials](), [vulnerabilities]() ### AI overview This introductory article explains vulnerability remediation as the process of fixing flaws identified by software scanners. It describes common obstacles, including triage, uncertainty about the affected code, and unclear ownership. It presents software bills of materials (SBOMs) as a way to identify software components, while noting that outdated or inaccurate SBOMs may miss vulnerabilities or malware. The article emphasizes that software vulnerabilities can affect everyone through data breaches, service disruptions, and physical harm. ### Source excerpt Learn the basics of vulnerability remediation from this teaser of Chainguard's Get Smart in Five Minutes series on Youtube. ## Mitigating software supply chain risks through faster vulnerability response and verified software images DevFeed: [Mitigating software supply chain risks through faster vulnerability response and verified software images]() Original publisher: [Read original article]() Published: 2024-04-16T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Vulnerabilities](), [open-source-security](), [chainguard images](), [supply chain attacks]() Tags: [auditability](), [chainguard-images](), [cve-2024-3094](), [golang](), [liblzma](), [sbom](), [software-bill-of-materials](), [software-supply-chain](), [supply-chain-attacks](), [supply-chain-integrity](), [supply-chain-security](), [vulnerabilities](), [xz](), [xz-backdoor](), [zero-trust]() ### AI overview The article discusses the xz vulnerability, the risk of future software supply chain attacks, and the importance of rapid patch propagation and software inventory auditability. It presents Chainguard Images as a continuously verified and auditable approach to mitigating these risks. ### Source excerpt Software backdoors are a threat. Learn how to mitigate supply chain security risks by responding faster to vulnerabilities like the xz flaw. ## Reproducible Builds at FOSDEM 2024 DevFeed: [Reproducible Builds at FOSDEM 2024]() Original publisher: [Read original article]() Published: 2024-02-08T00:00:00Z Content type: news Language: en Sources: [reproducible-builds.org]() Topics: [reproducible builds](), [FOSDEM](), [Arch Linux](), [Debian](), [Fedora](), [coreboot](), [software bill of materials]() Tags: [coreboot](), [debian](), [fedora](), [fosdem](), [org](), [reproducible-builds](), [software-bill-of-materials]() ### AI overview The article reports on Reproducible Builds activities at FOSDEM 2024. It highlights Holger Levsen's talk covering the project's history, current state, and future goals, along with other talks on reproducibility, confidential computing, RISC-V bootstrapping, reproducible development environments, HPC experiments, configuration options, and software bills of materials. ### Source excerpt Core Reproducible Builds developer Holger Levsen presented at the main track at FOSDEM on Saturday 3rd February this year in Brussels, Belgium. Titled Reproducible Builds: The First Ten Years... In this talk Holger 'h01ger' Levsen will give an overview about Reproducible Builds: How it started with a small BoF at DebConf13 (and before), then grew from being a Debian effort to something many projects work on together, until in 2021 it was mentioned in an Executive Order of the President of the United States. And of course, the talk will not end there, but rather outline where we are today and where we still need to be going, until Debian stable (and other distros!) will be 100% reproducible, verified by many. h01ger has been involved in reproducible builds since 2014 and so far has set up automated reproducibility testing for Debian, Fedora, Arch Linux, FreeBSD, NetBSD and coreboot. More information can be found on FOSDEM's own page for the talk, including a video recording and slides. Separate from Holger's talk, however, there were a number of other talks about reproducible builds at FOSDEM this year: Reproducible builds for confidential computing: Why remote attestation is worthless without it by Malte Poll and Paul Meyer. RISC-V Bootstrapping in Guix and Live-Bootstrap by Ekaitz. rix: an R package for reproducible dev environments with Nix by Bruno Rodrigues. Making reproducible and publishable large-scale HPC experiments by Philippe Swartvagher. Documenting and Fixing Non-Reproducible Builds due to Configuration Options by RANDRIANAINA Georges Aaron. ... and there was even an entire track on Software Bill of Materials. ## Software development security redefined: Sourcegraph's story DevFeed: [Software development security redefined: Sourcegraph's story]() Original publisher: [Read original article]() Published: 2023-12-20T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Security](), [supply-chain-security](), [chainguard images](), [open-source-security](), [chainguard](), [software bill of materials]() Tags: [chainguard](), [chainguard-images](), [customer-story](), [cve](), [open-source-software-security](), [software-bill-of-materials](), [software-supply-chain-security](), [sourcegraph](), [vulnerability-management]() ### AI overview This customer story describes how Sourcegraph used Chainguard Images, built on Wolfi OS, together with OpenVEX and SBOMs to simplify vulnerability management and strengthen software supply chain security. The article states that Sourcegraph achieved zero known vulnerabilities in a short timespan. ### Source excerpt Sourcegraph's story: leveraging Chainguard's technology for streamlined software development and heightened security. ## Top 5 takeaways from KubeCon NA 2023: SSCS, Wolfi and more DevFeed: [Top 5 takeaways from KubeCon NA 2023: SSCS, Wolfi and more]() Original publisher: [Read original article]() Published: 2023-11-21T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [open-source-security](), [Kubernetes](), [cloud-infrastructure]() Tags: [cloud-native](), [digital-signatures](), [kubecon](), [kubecon-na](), [kubernetes](), [open-source-software](), [sigstore](), [software-bill-of-materials](), [software-supply-chain-security](), [sscs](), [wofli](), [wolfi]() ### AI overview Chainguard reviews five takeaways from KubeCon North America 2023, focusing on the event's growth, the rising awareness of software supply chain security, and the shift toward implementing security tools and processes within software development. The article also highlights SBOMs, digital signatures, attestations, Wolfi, and related cloud-native topics. ### Source excerpt Chainguard's breakdown of KubeCon NA 2023: Top five highlights in software supply chain security, Wolfi, and more. ## Secure your software supply chain with the new Snyk Vulnerability Intelligence for SBOM ServiceNow integration DevFeed: [Secure your software supply chain with the new Snyk Vulnerability Intelligence for SBOM ServiceNow integration]() Original publisher: [Read original article]() Author: Sarah Conway Published: 2023-11-07T06:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [supply-chain-security](), [snyk-open-source](), [Vulnerabilities](), [Application Security]() Tags: [acquisition](), [awareness](), [blog](), [developer](), [related-content](), [sbom](), [sca](), [security](), [snyk](), [snyk-platform](), [software-bill-of-materials](), [software-composition-analysis](), [software-supply-chain](), [supply-chain](), [supply-chain-security](), [visibility](), [vulnerability]() ### AI overview The article introduces Snyk Vulnerability Intelligence for SBOM, an integration that brings Snyk vulnerability data into SBOMs stored in ServiceNow Vulnerability Response. It uses package URLs to identify vulnerable components, provides contextual severity and remediation information, and supports dashboards and workflows for tracking and fixing software supply chain risk. ### Source excerpt The new Snyk Vulnerability Intelligence for SBOM integration brings visibility to your SBOMs in ServiceNow Vulnerability Response for a more accurate understanding of risk within the enterprise supply chain. ## Software Bill of Materials DevFeed: [Software Bill of Materials]() Original publisher: [Read original article]() Author: John Lee Published: 2023-11-02T00:00:00Z Content type: tutorial Language: en Sources: [Blog on Developer Portal]() Topics: [software bill of materials](), [ESP-IDF](), [Espressif](), [supply-chain-security](), [NVD](), [Security]() Tags: [blog](), [esp-idf](), [esp32](), [espressif](), [iot](), [nvd](), [sbom](), [security](), [security-vulnerabilities](), [software-bill-of-materials](), [spdx](), [tools](), [vulnerabilities]() ### AI overview This article introduces software bills of materials (SBOMs), explains their structure and formats such as SPDX and CycloneDX, and presents Espressif's ESP-IDF-SBOM tool. The tool generates SPDX SBOMs for ESP-IDF-based applications and checks them against the National Vulnerability Database for known vulnerabilities. ### Source excerpt Overview# The "software bill of materials" (SBOM) has emerged as a key building block in software security and software supply chain risk management. An SBOM is a comprehensive list of all the software components, dependencies, and metadata associated with an application. Espressif believes that this information is a key step towards ensuring the security of the connected devices. And as such, we have now enabled easy to use tools and solutions to track and analyze this information. ## Celebrating innovation in open source software and container image security with Chainguard Images DevFeed: [Celebrating innovation in open source software and container image security with Chainguard Images]() Original publisher: [Read original article]() Published: 2023-11-01T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [container-security](), [supply-chain-security](), [open-source-security](), [Open Source]() Tags: [chainguard-images](), [container-image-security](), [container-security](), [fedramp](), [fips](), [open-source-software](), [sbom](), [sigstore](), [software-bill-of-materials](), [software-signatures](), [software-supply-chain-security](), [vulnerabilities](), [vulnerability-management]() ### AI overview Chainguard describes the growth of Chainguard Images as a secure container image offering for open source software development and software supply chain security. The article highlights more than one million image builds, over 90 million pulls, a large inventory of tools and applications, reduced CVEs, passwordless token-based authentication, SBOMs, and Sigstore-verified software signatures. ### Source excerpt Explore the fusion of open source innovation and container security with Chainguard Images. ## Grype Adds OpenVEX Support for Vulnerability Analysis DevFeed: [Grype Adds OpenVEX Support for Vulnerability Analysis]() Original publisher: [Read original article]() Published: 2023-10-10T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [grype](), [openvex](), [supply-chain-security](), [vulnerability management](), [anchore](), [chainguard](), [Security]() Tags: [anchore](), [chainguard](), [cve](), [cybersecurity-and-infrastructure-security-agency](), [grype](), [openssf](), [openvex](), [scanner](), [security](), [software-bill-of-materials](), [software-supply-chain-security](), [vex](), [vulnerability-management](), [vulnerability-scanner]() ### AI overview Grype, Anchore's open-source vulnerability scanner, now supports OpenVEX, a machine-readable standard for vulnerability analysis. The article explains how this can provide context for vulnerabilities and help reduce false positives and vulnerability-management effort. ### Source excerpt Open source vulnerability scanner Grype has added support for OpenVEX, making software supply chain security easier. Learn how to implement it today. ## Working with government and industry to put open source security tooling into practice DevFeed: [Working with government and industry to put open source security tooling into practice]() Original publisher: [Read original article]() Published: 2023-09-12T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [open-source-security](), [software bill of materials](), [supply-chain-security](), [Tooling](), [cisa](), [Docker Hardened Images]() Tags: [bombshell](), [chainguard](), [cisa](), [cyclonedx](), [open-source](), [open-source-security](), [protobom](), [sbom](), [security](), [software-bill-of-materials](), [software-supply-chain-security](), [spdx](), [vex]() ### AI overview Chainguard describes two open-source SBOM tools developed with the U.S. Department of Homeland Security and other startups: protobom, which translates SBOM data between formats, and bomshell, which combines and composes SBOMs. The initiative aims to improve software supply chain security and visibility. ### Source excerpt Pioneering SBOM tools with government and industry allies, Chainguard advances open source security measures. ## How Snyk can help secure supply chains per "A Guide to Implementing the Software Bill of Materials (SBOM) for Software Management"' by Japan's METI DevFeed: [How Snyk can help secure supply chains per "A Guide to Implementing the Software Bill of Materials (SBOM) for Software Management"' by Japan's METI]() Original publisher: [Read original article]() Author: Hiroko Nakano Published: 2023-08-01T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [supply-chain-security](), [vulnerability management](), [Security]() Tags: [application-security](), [asia-pacific-japan](), [awareness](), [blog](), [devops](), [japan](), [sbom](), [security](), [snyk](), [software-bill-of-materials](), [software-supply-chain](), [spdx](), [supply-chain-security](), [vulnerabilities]() ### AI overview This article explains Japan's METI guidance for implementing Software Bill of Materials (SBOM) practices and describes how Snyk can help organizations create and scan SBOMs for vulnerabilities. It outlines the guide's implementation phases and discusses software supply-chain security, vulnerability management, and development productivity. ### Source excerpt Snyk provides tools to create and scan SBOMs for vulnerabilities, helping organizations meet the requirements laid out by the METI Guide. This blog explores how Snyk can help to comply with the METI's guidance. ## Can Protobom end the SBOM format wars? DevFeed: [Can Protobom end the SBOM format wars?]() Original publisher: [Read original article]() Published: 2023-07-31T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Open Source](), [Library](), [open-source-security]() Tags: [cisa](), [collaboration](), [cyclonedx](), [library](), [open-source](), [protobom](), [pull-requests](), [sbom](), [sboms](), [security](), [software-bill-of-materials](), [software-supply-chain](), [software-supply-chain-security](), [spdx]() ### AI overview The article presents Protobom as an open source library designed to reduce the importance of choosing among SBOM formats. It provides a format-neutral representation of SBOM package and file data and translates that data between popular formats, allowing teams to focus more on software supply chain security. ### Source excerpt Probe the SBOM format wars: Can ProtoBOM herald a new era of consensus? Chainguard weighs in. ## Celebrating 5 years of NTIA's SBOM work DevFeed: [Celebrating 5 years of NTIA's SBOM work]() Original publisher: [Read original article]() Published: 2023-06-07T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Cybersecurity](), [Security](), [chainguard](), [cisa](), [distroless]() Tags: [chainguard](), [cisa](), [cybersecurity](), [distroless](), [fedramp](), [openvex](), [sbom](), [software-bill-of-materials](), [software-dark-matter](), [software-supply-chain](), [software-supply-chain-security](), [sofware-supply-chain](), [ssdf](), [vex](), [vulnerability-scanning]() ### AI overview The article commemorates five years of the NTIA's Software Bill of Materials work and reviews the development of SBOMs as a foundation of software supply chain security. It describes the NTIA's initiative, its multi-stakeholder guidelines, and CISA's continuing role in advancing software transparency. ### Source excerpt Celebrate 5 transformative years of SBOM work with Chainguard, reflecting on the journey of software bill of materials. ## How to explain the CISA software attestation requirements to your board DevFeed: [How to explain the CISA software attestation requirements to your board]() Original publisher: [Read original article]() Published: 2023-05-05T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [cisa](), [cybersecurity and infrastructure security agency](), [software bill of materials](), [Security]() Tags: [attestation](), [chainguard](), [cisa](), [container-security](), [government](), [national-cybersecurity-strategy](), [nist](), [policy](), [sbom](), [sboms](), [secure-container-image](), [secure-software](), [self-attestation](), [signing-artifacts](), [sigstore](), [software-artifact-signing](), [software-bill-of-materials](), [software-supply-chain-security](), [ssdf]() ### AI overview This article explains how software companies can brief their boards on CISA software attestation requirements and the broader federal software supply chain security policy landscape. It discusses Executive Order 14028, SBOMs, secure software development, CISA's Secure Software Development Attestation Form, and the requirements in OMB Memorandum M-22-18, including alignment with NIST guidance. ### Source excerpt CISA's draft self-attestation form clarifies the minimum requirements that software developers must meet to comply with OMB Memorandum M-22-18. ## OSS Security: Chainguard Spring 2023 update DevFeed: [OSS Security: Chainguard Spring 2023 update]() Original publisher: [Read original article]() Published: 2023-03-22T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [open-source-security](), [supply-chain-security](), [Open Source](), [Security](), [software bill of materials]() Tags: [chainguard](), [cloud-native](), [cloud-native-security-con](), [fosdem](), [foss](), [gitops](), [kubecon-eu](), [kubernetes](), [open-source-software](), [open-source-software-security](), [openssf](), [oss](), [sigstore](), [software-bill-of-materials](), [software-supply-chain](), [supply-chain-security]() ### AI overview Chainguard's Spring 2023 update describes its involvement in open-source software security during the first part of 2023. It covers community leadership, conference talks and workshops, software freedom advocacy, and efforts to make software bills of materials useful and widely adopted for supply-chain security. ### Source excerpt Chainguard believes open source is important and we mean it. Check out how we've been involved in OSS Security in the first part of 2023. ## Chainguard's perspective on the National Cybersecurity Strategy and secure software development DevFeed: [Chainguard's perspective on the National Cybersecurity Strategy and secure software development]() Original publisher: [Read original article]() Published: 2023-03-02T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Cybersecurity](), [open-source-security](), [software-development](), [Memory Safety](), [software bill of materials]() Tags: [chainguard](), [chainguard-enforce](), [cybersecurity](), [memory-safety](), [national-cybersecurity-strategy](), [nist](), [open-source-security](), [open-source-software](), [secure-by-default](), [software-bill-of-materials](), [software-supply-chain](), [software-supply-chain-security](), [standards](), [wolfi]() ### AI overview Chainguard discusses the National Cybersecurity Strategy's implications for software liability and secure software development, highlighting SBOM tooling, NIST frameworks, memory-safe languages, and open source software security. ### Source excerpt Chainguard's vision for a 'Secure by Default' future: Pioneering strategies to integrate security into the tech fabric. ## A purl of wisdom on SBOMs and vulnerabilities DevFeed: [A purl of wisdom on SBOMs and vulnerabilities]() Original publisher: [Read original article]() Published: 2023-02-14T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [open-source-security](), [Vulnerabilities](), [supply-chain-security]() Tags: [chainguard-images](), [component](), [components](), [container-images](), [false-positive](), [nvd](), [package-url](), [purl](), [sbom](), [sboms](), [scanner](), [software-bill-of-materials](), [software-supply-chain](), [vulnerabilities](), [vulnerability-data](), [vulnerability-scanner](), [vulnerability-scanning]() ### AI overview The article argues that Software Bill of Materials (SBOMs) would be more useful if the National Vulnerability Database (NVD) widely adopted the package URL (purl) naming scheme. Analysis of real scanner false positives suggests that purl information could reduce the false positive rate by more than 50%. ### Source excerpt SBOMs could be a lot more useful if the NVD implemented widespread usage of the purl naming scheme, which could reduce the false positive rate by over 50%.