Stacklok's Adolfo García Veytia Digs Into SBOMs and VEX
Jun 18, 2024
auto_awesome
Adolfo García Veytia, a Staff Software Engineer at Stacklok, delves into the importance of SBOMs, VEX projects, and standards in the software supply chain. He shares insights on open source contributions, communication tools, and advice for aspiring professionals.
Software Bill of Materials (S-BOM) enhances software transparency and informed decision-making for developers and consumers.
S-BOM standards like SPDX and Seq1DX, along with tools like Protobomb, streamline efficient management of S-BOM data.
Deep dives
Importance of Software Bill of Materials (S-BOM)
Software Bill of Materials (S-BOM) is crucial for transparency in the software supply chain, providing a detailed list of the components within a software. It enables developers and consumers to make informed decisions regarding the software they use, especially when incorporating third-party components. S-BOM serves as the foundation for a transparent supply chain, akin to knowing the ingredients of a meal before consuming it.
Types of S-BOM and their Evolution in the Software Lifecycle
S-BOM evolves across different stages of the software lifecycle, with various types such as design S-BOM, source S-BOM, build S-BOM, analyzed S-BOM, and deploy S-BOM. These variations capture changing information as the software progresses from conception to deployment. Each type focuses on distinct aspects like planning, code extraction, dependency versions, external assessments, and operational deployment.
Standards and Tools in the S-BOM Space
Two main standards for S-BOM are SPDX and Seq1DX, offering common abstractions to capture component lists and additional details like build provenance and AI workloads. Tools like Protobomb and BOM CTL assist in managing S-BOM data efficiently, facilitating operations like updating, mixing, and format conversions. These tools enhance user experience by providing a universal IO layer and essential CLI functionalities for managing S-BOM effectively.
The world of software bill of materials (SBOMs) is both complex and fascinating. And few people know the SBOM community better than Adolfo García Veytia — aka Puerco — Staff Software Engineer at Stacklok. Puerco is also a Technical Lead with Kubernetes SIG Release specializing in supply chain improvements to the software that drives the automation behind the release process.
Puerco is one of the original authors of OpenVEX, an OpenSSF project working towards a minimal implementation of VEX that can be easily embedded and attested. He's also a contributor to the SPDX project and a maintainer of several SBOM OSS tools. He’s passionate about writing software with friends, helping new contributors and amplifying the Latinx presence in the cloud-native community.
01:04 - Puerco shares his background
02:21 - What SBOMs are and why they’re so important
06:42 - An overview of standards in the SBOM space
09:58 - Puerco details his work on VEX projects
14:05 - Puerco enters the rapid-fire portion of the interview
15:06 - Advice Puerco would offer aspiring open source or security professionals