# software bill of materials A formal record of the components and supply-chain relationships used to build software. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Proven, not promised: Chainguard Containers achieves SLSA Build Level 3 DevFeed: [Proven, not promised: Chainguard Containers achieves SLSA Build Level 3]() Original publisher: [Read original article]() Published: 2026-08-17T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard containers](), [supply-chain-security](), [software bill of materials](), [Security]() Tags: [chainguard](), [chainguard-containers](), [provenance](), [sbom](), [security](), [signing](), [slsa](), [software-supply-chain-security](), [supply-chain]() ### AI overview Chainguard says Coalfire independently assessed the Chainguard Containers build and release system as meeting SLSA Build Level 3 requirements. The article describes hardened, isolated builds, separately managed signing, provenance generation, and signed SBOMs for releases. ### Source excerpt Coalfire independently assessed Chainguard Containers at SLSA Build Level 3, validating hardened builds, provenance, and supply chain integrity. ## Staying Ahead with ESP32 Security Updates DevFeed: [Staying Ahead with ESP32 Security Updates]() Original publisher: [Read original article]() Author: John Lee Published: 2026-03-05T00:00:00Z Content type: article Language: en Sources: [Blog on Developer Portal]() Topics: [ESP32](), [Security](), [vulnerability management](), [cyber resilience act](), [dashboards](), [ESP-IDF](), [Espressif](), [software bill of materials]() Tags: [blog](), [cyber-resilience-act](), [dashboards](), [esp-idf](), [esp32](), [espressif](), [iot](), [lts](), [ota](), [sbom](), [security](), [vulnerability]() ### AI overview This article explains how the ESP32 ecosystem supports long-term firmware security and compliance under regulations such as the EU Cyber Resilience Act. It covers vulnerability management, secure OTA updates, Long-Term Support branches, the ESP-IDF Security Dashboard, and SBOMs for tracking affected components and patched versions. ### Source excerpt This article explains how manufacturers can use the ESP32 ecosystem to build and maintain secure firmware over time, especially in light of new regulations like the EU Cyber Resilience Act. It highlights tools such as vulnerability dashboards, Long-Term Support branches, and secure OTA updates to ensure ongoing compliance and device security. ## Meeting the Zero-CVE Mandate: How Chainguard Helps Businesses Ship Secure Software That Customers Trust DevFeed: [Meeting the Zero-CVE Mandate: How Chainguard Helps Businesses Ship Secure Software That Customers Trust]() Original publisher: [Read original article]() Published: 2025-10-06T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [supply-chain-security](), [Containers](), [software bill of materials](), [Security]() Tags: [chainguard](), [chainguard-containers](), [chainguard-custom-assembly](), [chainguard-images](), [containers](), [cves](), [provenance](), [sboms](), [secure-software](), [security](), [software-supply-chain-security](), [zero-cves]() ### AI overview The article explains how Chainguard helps businesses meet stricter software security requirements for self-hosted, cloud, packaged-agent, and embedded software. It focuses on zero known CVEs at delivery, verifiable SBOMs, provenance attestations, compatibility with security tooling, and the challenges of open source dependencies and container images. ### Source excerpt Chainguard's zero-CVE containers come with broad compatibility, custom assembly, verifiable provenance and SBOMs, and more to help you ship secure software. ## Why Golden Images still matter and how to secure them with Chainguard DevFeed: [Why Golden Images still matter and how to secure them with Chainguard]() Original publisher: [Read original article]() Published: 2025-05-22T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [Security](), [DevOps](), [software bill of materials](), [Software](), [cloud-infrastructure](), [Open Source]() Tags: [aws](), [azure](), [chainguard](), [chainguard-containers](), [container-image](), [container-images](), [containers](), [devops](), [golden-image](), [golden-images](), [how-to](), [provenance](), [sbom](), [security](), [zero-cves]() ### AI overview This article explains why well-managed golden image programs remain important for modern software delivery. It describes how continuously rebuilt, patched, signed, scanned, and versioned images--with SBOMs, attestations, provenance, and policy compliance--can improve security and streamline development workflows, while presenting Chainguard as an alternative to homegrown programs. ### Source excerpt Golden container image programs can be a great way to increase efficiency and security for your engineering team. Learn how to do it right with Chainguard. ## Software Bill of Materials (SBOM) for your Spin Apps DevFeed: [Software Bill of Materials (SBOM) for your Spin Apps]() Original publisher: [Read original article]() Author: Thorsten Hans Published: 2025-01-16T12:00:00Z Content type: tutorial Language: en Sources: [Fermyon - Experience the next wave of cloud computing.]() Topics: [software bill of materials](), [supply-chain-security](), [trivy](), [Open Source](), [Requirements](), [Software]() Tags: [open-source](), [regulatory](), [sbom](), [software-bill-of-materials](), [software-supply-chain](), [supply-chain](), [trivy]() ### AI overview A tutorial on creating Software Bills of Materials for Spin apps, addressing regulatory requirements and software supply chain security with open-source tools such as Trivy. ### Source excerpt Learn how to create SBOMs for Spin apps, meet regulatory requirements, and secure your software supply chain with open-source tools like Trivy ## New Chainguard Academy Course: Linky's Guide to Chainguard Images DevFeed: [New Chainguard Academy Course: Linky's Guide to Chainguard Images]() Original publisher: [Read original article]() Published: 2024-10-23T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [container images](), [Security](), [software bill of materials](), [supply-chain-security]() Tags: [api](), [chainguard](), [chainguard-academy](), [chainguard-images](), [command-line](), [container](), [container-images](), [cosign](), [course](), [customer-course](), [education](), [federal-information-processing-standards](), [fips](), [getting-started](), [sbom](), [security](), [software-supply-chain-security]() ### AI overview Chainguard announces Linky's Guide to Chainguard Images, a seven-part course covering image acquisition, management, security, authentication, scanning, updates, the user interface, versions, chainctl, FIPS images, SBOMs, and build comparison. ### Source excerpt Linky's Guide to Chainguard Images is a set of courses for customers and prospects of Chainguard to learn more about our container images product. ## Get Smart in 5 Minutes: Vulnerability remediation unveiled DevFeed: [Get Smart in 5 Minutes: Vulnerability remediation unveiled]() Original publisher: [Read original article]() Published: 2024-08-16T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Vulnerabilities](), [software bill of materials](), [Security](), [Software]() Tags: [developer](), [sbom](), [scanners](), [security](), [software-bill-of-materials](), [vulnerabilities]() ### AI overview This introductory article explains vulnerability remediation as the process of fixing flaws identified by software scanners. It describes common obstacles, including triage, uncertainty about the affected code, and unclear ownership. It presents software bills of materials (SBOMs) as a way to identify software components, while noting that outdated or inaccurate SBOMs may miss vulnerabilities or malware. The article emphasizes that software vulnerabilities can affect everyone through data breaches, service disruptions, and physical harm. ### Source excerpt Learn the basics of vulnerability remediation from this teaser of Chainguard's Get Smart in Five Minutes series on Youtube. ## Reproducible Builds at FOSDEM 2024 DevFeed: [Reproducible Builds at FOSDEM 2024]() Original publisher: [Read original article]() Published: 2024-02-08T00:00:00Z Content type: news Language: en Sources: [reproducible-builds.org]() Topics: [reproducible builds](), [FOSDEM](), [Arch Linux](), [Debian](), [Fedora](), [coreboot](), [software bill of materials]() Tags: [coreboot](), [debian](), [fedora](), [fosdem](), [org](), [reproducible-builds](), [software-bill-of-materials]() ### AI overview The article reports on Reproducible Builds activities at FOSDEM 2024. It highlights Holger Levsen's talk covering the project's history, current state, and future goals, along with other talks on reproducibility, confidential computing, RISC-V bootstrapping, reproducible development environments, HPC experiments, configuration options, and software bills of materials. ### Source excerpt Core Reproducible Builds developer Holger Levsen presented at the main track at FOSDEM on Saturday 3rd February this year in Brussels, Belgium. Titled Reproducible Builds: The First Ten Years... In this talk Holger 'h01ger' Levsen will give an overview about Reproducible Builds: How it started with a small BoF at DebConf13 (and before), then grew from being a Debian effort to something many projects work on together, until in 2021 it was mentioned in an Executive Order of the President of the United States. And of course, the talk will not end there, but rather outline where we are today and where we still need to be going, until Debian stable (and other distros!) will be 100% reproducible, verified by many. h01ger has been involved in reproducible builds since 2014 and so far has set up automated reproducibility testing for Debian, Fedora, Arch Linux, FreeBSD, NetBSD and coreboot. More information can be found on FOSDEM's own page for the talk, including a video recording and slides. Separate from Holger's talk, however, there were a number of other talks about reproducible builds at FOSDEM this year: Reproducible builds for confidential computing: Why remote attestation is worthless without it by Malte Poll and Paul Meyer. RISC-V Bootstrapping in Guix and Live-Bootstrap by Ekaitz. rix: an R package for reproducible dev environments with Nix by Bruno Rodrigues. Making reproducible and publishable large-scale HPC experiments by Philippe Swartvagher. Documenting and Fixing Non-Reproducible Builds due to Configuration Options by RANDRIANAINA Georges Aaron. ... and there was even an entire track on Software Bill of Materials. ## Software development security redefined: Sourcegraph's story DevFeed: [Software development security redefined: Sourcegraph's story]() Original publisher: [Read original article]() Published: 2023-12-20T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Security](), [supply-chain-security](), [chainguard images](), [open-source-security](), [chainguard](), [software bill of materials]() Tags: [chainguard](), [chainguard-images](), [customer-story](), [cve](), [open-source-software-security](), [software-bill-of-materials](), [software-supply-chain-security](), [sourcegraph](), [vulnerability-management]() ### AI overview This customer story describes how Sourcegraph used Chainguard Images, built on Wolfi OS, together with OpenVEX and SBOMs to simplify vulnerability management and strengthen software supply chain security. The article states that Sourcegraph achieved zero known vulnerabilities in a short timespan. ### Source excerpt Sourcegraph's story: leveraging Chainguard's technology for streamlined software development and heightened security. ## Software Bill of Materials DevFeed: [Software Bill of Materials]() Original publisher: [Read original article]() Author: John Lee Published: 2023-11-02T00:00:00Z Content type: tutorial Language: en Sources: [Blog on Developer Portal]() Topics: [software bill of materials](), [ESP-IDF](), [Espressif](), [supply-chain-security](), [NVD](), [Security]() Tags: [blog](), [esp-idf](), [esp32](), [espressif](), [iot](), [nvd](), [sbom](), [security](), [security-vulnerabilities](), [software-bill-of-materials](), [spdx](), [tools](), [vulnerabilities]() ### AI overview This article introduces software bills of materials (SBOMs), explains their structure and formats such as SPDX and CycloneDX, and presents Espressif's ESP-IDF-SBOM tool. The tool generates SPDX SBOMs for ESP-IDF-based applications and checks them against the National Vulnerability Database for known vulnerabilities. ### Source excerpt Overview# The "software bill of materials" (SBOM) has emerged as a key building block in software security and software supply chain risk management. An SBOM is a comprehensive list of all the software components, dependencies, and metadata associated with an application. Espressif believes that this information is a key step towards ensuring the security of the connected devices. And as such, we have now enabled easy to use tools and solutions to track and analyze this information. ## Working with government and industry to put open source security tooling into practice DevFeed: [Working with government and industry to put open source security tooling into practice]() Original publisher: [Read original article]() Published: 2023-09-12T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [open-source-security](), [software bill of materials](), [supply-chain-security](), [Tooling](), [cisa](), [Docker Hardened Images]() Tags: [bombshell](), [chainguard](), [cisa](), [cyclonedx](), [open-source](), [open-source-security](), [protobom](), [sbom](), [security](), [software-bill-of-materials](), [software-supply-chain-security](), [spdx](), [vex]() ### AI overview Chainguard describes two open-source SBOM tools developed with the U.S. Department of Homeland Security and other startups: protobom, which translates SBOM data between formats, and bomshell, which combines and composes SBOMs. The initiative aims to improve software supply chain security and visibility. ### Source excerpt Pioneering SBOM tools with government and industry allies, Chainguard advances open source security measures. ## How to explain the CISA software attestation requirements to your board DevFeed: [How to explain the CISA software attestation requirements to your board]() Original publisher: [Read original article]() Published: 2023-05-05T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [cisa](), [cybersecurity and infrastructure security agency](), [software bill of materials](), [Security]() Tags: [attestation](), [chainguard](), [cisa](), [container-security](), [government](), [national-cybersecurity-strategy](), [nist](), [policy](), [sbom](), [sboms](), [secure-container-image](), [secure-software](), [self-attestation](), [signing-artifacts](), [sigstore](), [software-artifact-signing](), [software-bill-of-materials](), [software-supply-chain-security](), [ssdf]() ### AI overview This article explains how software companies can brief their boards on CISA software attestation requirements and the broader federal software supply chain security policy landscape. It discusses Executive Order 14028, SBOMs, secure software development, CISA's Secure Software Development Attestation Form, and the requirements in OMB Memorandum M-22-18, including alignment with NIST guidance. ### Source excerpt CISA's draft self-attestation form clarifies the minimum requirements that software developers must meet to comply with OMB Memorandum M-22-18. ## OSS Security: Chainguard Spring 2023 update DevFeed: [OSS Security: Chainguard Spring 2023 update]() Original publisher: [Read original article]() Published: 2023-03-22T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [open-source-security](), [supply-chain-security](), [Open Source](), [Security](), [software bill of materials]() Tags: [chainguard](), [cloud-native](), [cloud-native-security-con](), [fosdem](), [foss](), [gitops](), [kubecon-eu](), [kubernetes](), [open-source-software](), [open-source-software-security](), [openssf](), [oss](), [sigstore](), [software-bill-of-materials](), [software-supply-chain](), [supply-chain-security]() ### AI overview Chainguard's Spring 2023 update describes its involvement in open-source software security during the first part of 2023. It covers community leadership, conference talks and workshops, software freedom advocacy, and efforts to make software bills of materials useful and widely adopted for supply-chain security. ### Source excerpt Chainguard believes open source is important and we mean it. Check out how we've been involved in OSS Security in the first part of 2023. ## Chainguard's perspective on the National Cybersecurity Strategy and secure software development DevFeed: [Chainguard's perspective on the National Cybersecurity Strategy and secure software development]() Original publisher: [Read original article]() Published: 2023-03-02T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Cybersecurity](), [open-source-security](), [software-development](), [Memory Safety](), [software bill of materials]() Tags: [chainguard](), [chainguard-enforce](), [cybersecurity](), [memory-safety](), [national-cybersecurity-strategy](), [nist](), [open-source-security](), [open-source-software](), [secure-by-default](), [software-bill-of-materials](), [software-supply-chain](), [software-supply-chain-security](), [standards](), [wolfi]() ### AI overview Chainguard discusses the National Cybersecurity Strategy's implications for software liability and secure software development, highlighting SBOM tooling, NIST frameworks, memory-safe languages, and open source software security. ### Source excerpt Chainguard's vision for a 'Secure by Default' future: Pioneering strategies to integrate security into the tech fabric. ## Make SBOMs, not GuessBOMs: Why we need to shift left on SBOM generation DevFeed: [Make SBOMs, not GuessBOMs: Why we need to shift left on SBOM generation]() Original publisher: [Read original article]() Published: 2023-01-26T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [software bill of materials](), [supply-chain-security](), [software dark matter](), [vulnerability management](), [Reverse Engineering](), [Containers]() Tags: [apko](), [chainguard-images](), [container-security](), [guessbom](), [melange](), [reverse-engineering](), [sbom](), [sboms](), [sca](), [shift-left](), [software-composition-analysis](), [software-dark-matter](), [software-supply-chain](), [vulnerability]() ### AI overview The article argues that SBOMs generated after a build by software composition analysis tools can be incomplete because they may miss components that bypass recorded metadata, such as files copied through Dockerfiles. It presents build-time generation as a better way to produce complete SBOMs and describes untracked files as software dark matter, which can make post-build SBOMs closer to best guesses than reliable inventories. ### Source excerpt GuessBOMs, SBOMs generated by reverse-engineering software artifacts, have severe limitations. The optimal point for generating complete SBOMs is at build time.