Software bill of materials

As explained in Effective Platform Engineering

A software bill of materials is a structured inventory of the components and dependencies contained in a software product.

A software bill of materials (SBOM) is a signed inventory of the packages included in a built software image from outside its source repository. It provides provenance and a cryptographic way to verify the image and incorporated packages. section 4.3.1

A platform can make SBOM handling routine by:

• Generating an SBOM during the CI/CD build. section 4.3.1
• Attaching the signed SBOM to images stored in a content-trusted registry. section 4.3.1
• Using versioned pipeline code or starter kits so teams do not perform the process manually. section 4.3.1

Figure 4.7 Steps along the way, from code creation to deployment, can automatically create the necessary provenance.

Trace how automated delivery steps create provenance from code creation through deployment. section 4.3.1

How Effective Platform Engineering covers it

How deep it goes

Explains contents, signing, integrity verification, registry placement, and pipeline automation, but does not detail an SBOM format.

Examples

Uses a platform pipeline that builds an image, records external packages, signs the SBOM, and stores the image in a trusted registry.

What it assumes

Assumes familiarity with source repositories, CI/CD pipelines, artifact stores, image registries, and software packages.

What you can do after

Operate/configure CI/CD pipelines to generate signed SBOMs and enforce their inclusion in deployed images.

How it connects

Connects SBOMs with CI/CD pipelines, container images, content trust, provenance, signed commits, and software supply-chain security.

liveBookmanning.com

Read Effective Platform Engineering on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  GitHub Actions in Action: Continuous integration and delivery for DevOpsA software bill of materials is a structured inventory of the components and dependencies contained in a software product.

Compare how 2 books explain software bill of materials →

Related concepts

• custom softwareused by · Custom software is software developed specifically for a particular organization, user, application, system, or integration rather than provided as a general-purpose product.
• dependencyuses · A software dependency is a component, resource, or prerequisite on which another software component or operation relies to function or proceed.

This explainer was generated by Manning's knowledge graph from the text of Effective Platform Engineering. The section links point to the parts of the book it draws on.