A first pass at understanding SBOMs

An SBOM is a nested inventory of what’s inside a piece of software. Every direct dependency, every transitive one, versions, licenses, sometimes hashes. Two dominant formats: CycloneDX and SPDX.

The pitch: if you know what’s inside your software, you can answer “am I affected by this CVE?” without guessing.

What I’m still working out

• How SBOMs stay accurate over time — a snapshot at build isn’t the same as what’s actually running
• Whether SBOM signing (via things like sigstore) is where the real value comes from
• How the Cyber Resilience Act in the EU actually operationalises this in practice
• What the workflow looks like inside a real security team

This is a seedling. Come back later — I’ll have more to say once I’ve spent more time in the tools.