# spdx Published articles for spdx. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Super SBOMs: See exactly what's inside DevFeed: [Super SBOMs: See exactly what's inside]() Original publisher: [Read original article]() Published: 2026-01-29T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard containers](), [Containers](), [chainguard](), [Security](), [spdx]() Tags: [chainguard-containers](), [chainguard-sboms](), [containers](), [cyclonedx](), [fedramp](), [sbom](), [sboms](), [security](), [software-bill-of-materials](), [software-supply-chain-security](), [spdx](), [vulnerability]() ### AI overview Chainguard Containers now provide richer SBOMs with binary-level details about embedded libraries and dependencies, along with CycloneDX support in addition to SPDX. The added visibility helps teams trace vulnerabilities and assess license compliance. ### Source excerpt Chainguard Containers ship richer SBOMs with binary-level library details plus new CycloneDX support, making CVE impact and compliance tracing fast and clear. ## Software Bill of Materials DevFeed: [Software Bill of Materials]() Original publisher: [Read original article]() Author: John Lee Published: 2023-11-02T00:00:00Z Content type: tutorial Language: en Sources: [Blog on Developer Portal]() Topics: [software bill of materials](), [ESP-IDF](), [Espressif](), [supply-chain-security](), [NVD](), [Security]() Tags: [blog](), [esp-idf](), [esp32](), [espressif](), [iot](), [nvd](), [sbom](), [security](), [security-vulnerabilities](), [software-bill-of-materials](), [spdx](), [tools](), [vulnerabilities]() ### AI overview This article introduces software bills of materials (SBOMs), explains their structure and formats such as SPDX and CycloneDX, and presents Espressif's ESP-IDF-SBOM tool. The tool generates SPDX SBOMs for ESP-IDF-based applications and checks them against the National Vulnerability Database for known vulnerabilities. ### Source excerpt Overview# The "software bill of materials" (SBOM) has emerged as a key building block in software security and software supply chain risk management. An SBOM is a comprehensive list of all the software components, dependencies, and metadata associated with an application. Espressif believes that this information is a key step towards ensuring the security of the connected devices. And as such, we have now enabled easy to use tools and solutions to track and analyze this information. ## Working with government and industry to put open source security tooling into practice DevFeed: [Working with government and industry to put open source security tooling into practice]() Original publisher: [Read original article]() Published: 2023-09-12T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [open-source-security](), [software bill of materials](), [supply-chain-security](), [Tooling](), [cisa](), [Docker Hardened Images]() Tags: [bombshell](), [chainguard](), [cisa](), [cyclonedx](), [open-source](), [open-source-security](), [protobom](), [sbom](), [security](), [software-bill-of-materials](), [software-supply-chain-security](), [spdx](), [vex]() ### AI overview Chainguard describes two open-source SBOM tools developed with the U.S. Department of Homeland Security and other startups: protobom, which translates SBOM data between formats, and bomshell, which combines and composes SBOMs. The initiative aims to improve software supply chain security and visibility. ### Source excerpt Pioneering SBOM tools with government and industry allies, Chainguard advances open source security measures. ## How Snyk can help secure supply chains per "A Guide to Implementing the Software Bill of Materials (SBOM) for Software Management"' by Japan's METI DevFeed: [How Snyk can help secure supply chains per "A Guide to Implementing the Software Bill of Materials (SBOM) for Software Management"' by Japan's METI]() Original publisher: [Read original article]() Author: Hiroko Nakano Published: 2023-08-01T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [supply-chain-security](), [vulnerability management](), [Security]() Tags: [application-security](), [asia-pacific-japan](), [awareness](), [blog](), [devops](), [japan](), [sbom](), [security](), [snyk](), [software-bill-of-materials](), [software-supply-chain](), [spdx](), [supply-chain-security](), [vulnerabilities]() ### AI overview This article explains Japan's METI guidance for implementing Software Bill of Materials (SBOM) practices and describes how Snyk can help organizations create and scan SBOMs for vulnerabilities. It outlines the guide's implementation phases and discusses software supply-chain security, vulnerability management, and development productivity. ### Source excerpt Snyk provides tools to create and scan SBOMs for vulnerabilities, helping organizations meet the requirements laid out by the METI Guide. This blog explores how Snyk can help to comply with the METI's guidance. ## Can Protobom end the SBOM format wars? DevFeed: [Can Protobom end the SBOM format wars?]() Original publisher: [Read original article]() Published: 2023-07-31T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Open Source](), [Library](), [open-source-security]() Tags: [cisa](), [collaboration](), [cyclonedx](), [library](), [open-source](), [protobom](), [pull-requests](), [sbom](), [sboms](), [security](), [software-bill-of-materials](), [software-supply-chain](), [software-supply-chain-security](), [spdx]() ### AI overview The article presents Protobom as an open source library designed to reduce the importance of choosing among SBOM formats. It provides a format-neutral representation of SBOM package and file data and translates that data between popular formats, allowing teams to focus more on software supply chain security. ### Source excerpt Probe the SBOM format wars: Can ProtoBOM herald a new era of consensus? Chainguard weighs in. ## Chainguard to accelerate VEX adoption through OpenVEX specification DevFeed: [Chainguard to accelerate VEX adoption through OpenVEX specification]() Original publisher: [Read original article]() Published: 2023-01-31T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [openvex](), [chainguard](), [supply-chain-security](), [anchore](), [Vulnerabilities]() Tags: [anchore](), [chainguard](), [chainguard-images](), [cyclonedx](), [false-positives](), [google](), [images](), [linux-foundation](), [openvex](), [sbom-vex](), [scanners](), [security](), [software-supply-chain](), [spdx](), [supply-chain](), [vex](), [vulnerabilities](), [vulnerability](), [vulnerability-tool](), [wolfi]() ### AI overview Chainguard announces the OpenVEX specification and reference toolchain, developed with industry and CISA VEX Working Group collaboration. OpenVEX helps software producers describe vulnerability exploitability and enables consumers to filter false positives, complementing SBOMs. ### Source excerpt VEX needs the industry to come together to build formats that integrate into existing practices. OpenVEX enables organizations to put VEX into practice. ## Gradle dependency license validation DevFeed: [Gradle dependency license validation]() Original publisher: [Read original article]() Author: Jake Wharton Published: 2021-06-08T00:00:00Z Content type: tutorial Language: en Sources: [Jake Wharton]() Topics: [Gradle](), [spdx](), [Android](), [Open Source]() Tags: [dependencies](), [gradle](), [gradle-plugin](), [open-source](), [software-license](), [spdx](), [validation]() ### AI overview This post explains how Cash App automated dependency license discovery and validation for its Android app using a new Gradle plugin called Licensee. The plugin normalizes license data to SPDX identifiers, supports allow-list validation that can fail builds for disallowed licenses, and serializes the results as JSON for use in the app's UI. It is intended to work with any Gradle-based project. ### Source excerpt This post was published externally on Cash App Code Blog. Read it at https://code.cash.app/gradle-dependency-license-validation. ## Gradle Plugin Portal Approval Policy Update DevFeed: [Gradle Plugin Portal Approval Policy Update]() Original publisher: [Read original article]() Author: Eric Wendelin Published: 2018-10-18T04:00:00Z Content type: release Language: en Sources: [The Gradle Blog]() Topics: [Gradle](), [Open Source](), [Security]() Tags: [github](), [gradle](), [issue](), [open-source](), [plugin](), [plugins](), [policy](), [repo](), [security](), [spdx](), [update]() ### AI overview Gradle is updating its approval policy for new plugins submitted to the Gradle Plugin Portal. The policy introduces validation of plugin descriptions, project URLs, group IDs, and artifact IDs, while prioritizing plugins with valid open-source repositories and properly applied SPDX-compatible licenses. ### Source excerpt Gradle is updating the plugin approval policy for plugins submitted to the Gradle Plugin Portal, effective today, to begin adding stronger security safeguards for plugin consumers. First off, this does not affect plugins already on the plugin portal, just new plugins. Gradle builds that use plugins will not be affected in any way. Portal acceptance criteria in a nutshell Gradle will check the following for new plugins submitted to plugins.gradle.org: Description and project URL are valid and not misleading The group ID and artifact ID are valid and not misleading In addition to these changes, plugins with a valid open-source repo URL will be prioritized over other plugins for approval. Those that apply a SPDX-compatible license properly, even more so. If your plugin doesn't meet these requirements, we'll let you know as soon as possible and give you a chance to re-submit when it does. If your plugin cannot comply, please publish it to an alternative repository and use the pluginManagement {} DSL to configure where your plugins {} are resolved from. What happens to plugins that don't adhere to this criteria These checks do not yet apply for subsequent versions of a given plugin, and aren't yet going to be retroactively enforced. In the longer term, we will begin showing warnings on the plugin portal for plugins that don't adhere to this policy, and may introduce additional automated checks to give plugin consumers information about plugins they're viewing. If you have questions or concerns, we encourage you to discuss in the plugin-portal category on the Gradle forum. For any support requests, please open a GitHub issue.