DevSecOps in Practice

Understanding the Software Bill of Materials (SBOM)

A Software Bill of Materials (SBOM) is an essential component in modern software development as it provides a detailed inventory of all dependencies, libraries, and components used in a software project. It is analogous to a supply chain manifest in manufacturing, listing every piece that goes into the final product.

A car manufacturer, for example, would have a bill of materials that includes the engine, tires, seats, and other parts that make up the vehicle. Similarly, a dockerized Python application might have a bill of materials that includes the base image, Python libraries, and other dependencies.

In the context of software development, an application is assembled from various components, including:

• Software as built by the development team
• Open-source and third-party libraries and frameworks
• Software as built (artifacts, binaries, etc.)
• Configuration files
• Scripts and other resources
• Operating system components (e.g., libraries, drivers)
• Docker images and containers
• Cloud services and APIs
• Licenses and legal terms
• Cryptographic keys and certificates
• Build tools and scripts