Software Bill of Materials
Donald discusses the significance of SIG store in simplifying code signing, particularly within open source ecosystems. He explains the concept of a software bill of materials as an essential "ingredients list" for applications, highlighting its role in identifying vulnerabilities and understanding component standards. However, he cautions that merely listing components does not guarantee security; it merely lays the groundwork for deeper analysis.In this clip
From this podcast
Software Engineering Radio - the podcast for professional software developers
Episode 541: Jordan Harband and Donald Fisher on Securing the Supply Chain
Related Questions