SBOMs
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
produce a software bill of materials for every build.
Planned topics
- An SBOM lists every component and version in an artifact.
- CycloneDX and SPDX are the common formats; for Maven, the CycloneDX plugin generates one per build.
- When a new CVE appears, search the stored SBOMs to find affected services in minutes.
- Generate SBOMs for the container image too, not only for the code.
Draft outline details
Demonstration
mvn org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom (verify plugin version before recording) and a short excerpt of the JSON component list.
Check your understanding
What question does an SBOM answer after a new CVE?
Show answer
Which of our artifacts contain that library and version?
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.