SBOM on OpenChain KWG

OSV-SCALIBR

Mon, 01 Jan 0001 00:00:00 +0000

OSV-SCALIBR (Open Source Vulnerabilities - Software Composition Analysis LIBRary) is an open source software composition analysis tool developed by Google. It scans filesystems, container images, and binaries to identify included packages and detects known vulnerabilities by cross-referencing the OSV (Open Source Vulnerabilities) database. It also supports SBOM generation in SPDX format.

GitHub: https://github.com/google/osv-scalibr
License: Apache-2.0

1. Features

Multiple scan targets: Local filesystem, container images, archive files
Wide ecosystem support: Go, Python, Java (Maven), JavaScript (npm), Rust, Ruby, and more
OSV DB integration: Cross-references scan results with the OSV database to provide CVE and other vulnerability information
SBOM output: Exports results in SPDX 2.3 format
CLI and library: Provided as both a standalone binary (CLI) and a Go library

2. Installation

Build with Go 1.21 or later:

cdxgen

Mon, 01 Jan 0001 00:00:00 +0000

cdxgen is an open source SBOM generation tool managed by OWASP (Open Web Application Security Project). It analyzes source code, build artifacts, and container images to automatically generate SBOMs in CycloneDX format.

GitHub: https://github.com/CycloneDX/cdxgen
License: Apache-2.0

Features

Wide language and ecosystem support: Java (Maven/Gradle), Node.js, Python, Go, Rust, PHP, Ruby, .NET, and 20+ more
Multiple scan targets: Source code directories, container images, GitHub repositories
CycloneDX standard output: Supports CycloneDX 1.4/1.5/1.6 in JSON and XML formats
REPL mode: Interactive interface for exploring and querying SBOMs
CI/CD integration: Easy integration with GitHub Actions, GitLab CI, and other major pipelines

Installation

Install with Node.js 18 or later:

Syft

Mon, 01 Jan 0001 00:00:00 +0000

Syft is an open source SBOM generation CLI tool developed by Anchore. It scans container images, filesystems, and archives to identify included packages and generates SBOMs in SPDX or CycloneDX format.

GitHub: https://github.com/anchore/syft
License: Apache-2.0

Features

Multiple scan targets: Container images (Docker, OCI), local filesystems, tar archives
Wide ecosystem support: Alpine (apk), Debian/Ubuntu (dpkg), RPM, Python, Java, Go, Node.js, Ruby, Rust, and more
Standard output formats: SPDX 2.2/2.3 (JSON, tag-value), CycloneDX 1.4/1.5 (JSON, XML), Syft JSON
Grype integration: Pairs naturally with Anchore’s Grype vulnerability scanner for SBOM-based vulnerability analysis
Easy installation: Single binary distribution, no additional runtime required

Installation

Script Installation (Linux/macOS)

curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin

Homebrew (macOS)

brew install syft

Docker

docker pull anchore/syft

Basic Usage

(1) Scan a Container Image

# Scan a Docker image and output SPDX JSON
syft ubuntu:22.04 -o spdx-json=sbom.spdx.json

# Output as CycloneDX JSON
syft ubuntu:22.04 -o cyclonedx-json=sbom.cdx.json

(2) Scan a Local Directory

syft dir:/path/to/project -o spdx-json=sbom.spdx.json

(3) View Results in Terminal

# Print package list to terminal
syft ubuntu:22.04

# Output as JSON to stdout
syft ubuntu:22.04 -o json

(4) Vulnerability Scanning with Grype

# Generate SBOM with Syft and analyze vulnerabilities with Grype
syft ubuntu:22.04 -o json | grype

CI/CD Integration Example

# GitHub Actions example
- name: Generate SBOM with Syft
 uses: anchore/sbom-action@v0
 with:
 image: myapp:latest
 format: spdx-json
 output-file: sbom.spdx.json
- name: Upload SBOM
 uses: actions/upload-artifact@v4
 with:
 name: sbom
 path: sbom.spdx.json

References

Syft GitHub: https://github.com/anchore/syft
Grype (vulnerability scanner): https://github.com/anchore/grype
SPDX Standard: https://spdx.dev/
CycloneDX Standard: https://cyclonedx.org/

Dependency-Track

Mon, 01 Jan 0001 00:00:00 +0000

Dependency-Track is an open source SBOM management and vulnerability analysis platform managed by OWASP. It continuously monitors component-level vulnerabilities based on uploaded SBOMs (CycloneDX, SPDX) and automatically evaluates policy violations.

GitHub: https://github.com/DependencyTrack/dependency-track
Official docs: https://docs.dependencytrack.org/
License: Apache-2.0

Features

SBOM-based continuous monitoring: Automatically tracks the latest vulnerabilities per component after uploading SBOMs in SPDX or CycloneDX format
Multiple vulnerability data sources: NVD, OSV, GitHub Advisories, VulnDB, and more
Policy engine: Define rules for license policies, vulnerability severity thresholds, and component allowlists for automatic evaluation
REST API: Integrate with CI/CD pipelines to automatically upload SBOMs and receive feedback at build time
Web UI dashboard: View per-project risk scores, vulnerability status, and license distribution at a glance
Notifications: Send new vulnerability alerts via Slack, email, Webhook, and other channels

Installation

Using Docker Compose is the simplest approach:

Building an Automated Open Source Management Environment: cdxgen + Dependency-Track

Mon, 01 Jan 0001 00:00:00 +0000

For companies just starting with open source management, we recommend the cdxgen + Dependency-Track combination as a toolset that can establish a basic automation environment within a single day.

This guide walks you through every step, from installation and configuration to setting up a license and vulnerability inspection environment and running day-to-day operations.

Why cdxgen + Dependency-Track

Open source management comes down to two essentials.

Know what is inside — generating an SBOM (Software Bill of Materials)
Continuously monitor risk — detecting vulnerabilities (CVEs) and license policy violations

cdxgen handles the first, and Dependency-Track handles the second. Both tools are free open source under the Apache-2.0 license.

SCANOSS

Mon, 01 Jan 0001 00:00:00 +0000

SCANOSS is a Software Composition Analysis (SCA) tool that can identify open source components not only at the file level but down to the snippet (code fragment) level. It detects license and copyright information by matching against a knowledge base (OSSKB, Open Source Knowledge Base) that indexes more than 100 million files, and automatically generates SBOMs in CycloneDX and SPDX formats.

GitHub: https://github.com/scanoss
Official site: https://www.scanoss.com
License: Apache-2.0

1. Key features

Snippet-level matching: Can trace the origin even when a portion of code, rather than an entire file, has been copied or modified
Large-scale knowledge base: OSSKB indexes more than 100 million open source files — covering major package repositories and GitHub
Automatic SBOM generation: Supports CycloneDX (JSON/XML) and SPDX format output
Both CLI & REST API: Provides both the scanoss-py (Python) CLI and a REST API, making automation integration easy
CI/CD pipeline integration: Can scan with a single command in CI environments such as GitHub Actions

2. Installation

Install via pip in a Python 3.8 or later environment.

§3.3.1 SBOM

Mon, 01 Jan 0001 00:00:00 +0000

1. Clause Overview

Without knowing what open source components are included in the supplied software, it is impossible to fulfill license obligations or respond to security vulnerabilities. §3.3.1 requires the establishment of a procedure for identifying, tracking, reviewing, approving, and archiving the open source components that make up supplied software, and maintaining component records (SBOM) that demonstrate the procedure has actually been followed. This clause forms the foundation for operating the SBOM, which is the core infrastructure of open source license compliance and Security Assurance.

§4.3.1 SBOM

Mon, 01 Jan 0001 00:00:00 +0000

1. Clause Overview

§4.3.1 has the same basic structure as ISO/IEC 5230 §3.3.1 (SBOM), but the emphasis differs. While 5230 covers the SBOM for license management of open source components, §4.3.1 of 18974 emphasizes continuously recording and retaining the SBOM throughout the entire software lifecycle. In particular, the SBOM must be maintained even after deployment so it can be integrated with the vulnerability monitoring in §4.3.2 Security Assurance. Without an SBOM, post-deployment impact analysis for newly published CVEs (§4.1.5 Method 5) cannot be performed.

TRUSCA

Mon, 01 Jan 0001 00:00:00 +0000

Managing the vulnerabilities and licenses of open source components calls for an SCA (Software Composition Analysis) tool. Several commercial products exist, but some organizations look for an open source tool they can install and run on their own infrastructure.

TRUSCA is a self-hosted SCA portal published for that purpose. Released under Apache 2.0, it brings vulnerabilities (CVE), license compliance, and SBOM management into a single screen. It is developed by Trusted OSS, a project that grew out of KWG community work.

28th Meeting

Mon, 01 Jan 0001 00:00:00 +0000

Schedule

Date and Time: December 9, 2025 (Tuesday), 2:00 PM – 4:50 PM
Venue: Hancom Tower (Pangyo - https://maps.app.goo.gl/Nq3XHZtPrg9Zvtzn7)

Agenda

Time	Agenda	Speaker	Slide
14:00~14:05	Welcome & Opening	Jihwan Jeong CTO, Hancom	-
14:05~14:20	OpenChain Update	Haksung Jang, SK Telecom	slide
14:20~14:45	Sharing Hancom’s OpenChain Certification Declaration Preparation	Hyunjoo Ryu, Hancom	pdf
14:45~15:10	Introduction to OpenPDF Data Loader and Tips for Open Source Disclosure Using AI	Bundo Lee, Hancom	pdf
15:10~15:50	Networking (Group Discussion)	All	-
15:50~16:00	Telechips’ OpenChain Certification and Remaining Challenges	Jiyoung Yeon, Telechips	pdf
16:00~16:10	About Cryptography Bill of Materials (CBOM)	Jinyoung Chae, Samsung SDS	-
16:10~16:25	Tooling & Legal Group Major Activities and Review	Wonjae Park, LG Electronics	-
16:25~16:50	2025 Review & Awards	Darae Ahn, Samsung Electronics	slide

31st Meeting

Mon, 01 Jan 0001 00:00:00 +0000

31st Meeting

Software Supply Chain Security and Open Source Governance

We look at the state of open source governance at CJ Group, how an open source management framework runs from an operations team's perspective, and tools for software supply chain security.

Date 2026-09-08 (Tue) 14:00–17:00 Venue CJ Human Resources Development Center · Jung-gu, Seoul

Directions Google Maps Naver Map Kakao Map

Registration and the detailed program are announced via the OpenChain KWG mailing list. Subscribe to receive the sign-up link.

Join the mailing list

08 Sep 2026 · Tue

CISA 2026 SBOM Minimum Elements: What to Prepare and Which Tools Fill the Gaps

Sun, 09 Aug 2026 00:00:00 +0000

This article was written with Claude Code, and the key facts cited here were cross-checked against primary sources.

Summary

On July 29, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) and 17 other agencies published a revised set of minimum elements for a Software Bill of Materials (SBOM)A2. The document states plainly that it replaces, rather than amends, the baseline established in 2021 by the National Telecommunications and Information Administration (NTIA).

What the US AI Executive Order (2026-06-02) Means for Enterprise Open Source Managers

Wed, 10 Jun 2026 00:00:00 +0000

This article was written with Claude Code, and the key facts cited here were cross-checked against primary sources.

Summary

The executive order “Promoting Advanced Artificial Intelligence Innovation and Security,” signed on June 2, 2026, imposes no obligations on enterprises. Its substance is the Treasury Department-led AI Cybersecurity Clearinghouse (a relay body that pools, verifies, and distributes vulnerability information, to be established within 30 days) and a voluntary pre-disclosure framework for frontier models (to be designed within 60 days); mandatory licensing and pre-approval are explicitly excluded A1. No provision applies directly to enterprise open source managers either. Still, there is a reason to read this order: the context behind it. AI finding open source vulnerabilities faster than humans do has already become reality. Ahead of the executive order, an unreleased Anthropic model found 6,202 high- or critical-severity vulnerabilities in open source projects over two months, and patching has not kept pace A6·C1. What open source managers need to prepare is not compliance with the executive order, but a response system that can handle a check of patch-processing capacity, cleanup of end-of-life (EOL) components, and the EU Cyber Resilience Act reporting obligation taking effect September 11, 2026, all at once.

EU Cyber Resilience Act (CRA) Vulnerability Reporting Obligations — A Research Report for the 2026-09-11 Compliance Date

Mon, 18 May 2026 00:00:00 +0000

This article was written with Claude Code, and the key facts cited here were cross-checked against primary sources.

Summary

The EU Cyber Resilience Act (Cyber Resilience Act, CRA — Regulation (EU) 2024/2847) is the EU’s first comprehensive product security regulation, imposing horizontal cybersecurity obligations on every “product with digital elements” (PDE) placed on the EU market. The regulation entered into force on December 10, 2024, and applies in phases. From September 11, 2026, the Article 14 reporting obligations take effect, requiring manufacturers, importers, and distributors to notify ENISA (the European Union Agency for Cybersecurity) and Member State CSIRTs of actively exploited vulnerabilities and severe incidents within a staged 24-hour, 72-hour, and 14-day window. Companies that have not stood up a reporting workflow by this date face fines of up to €15 million or 2.5% of worldwide annual turnover, and Korean companies that place products on the EU market are subject to the obligation immediately. A1, B1, E1

2025-12-04 SBOM 표준화와 최신 이슈들

Thu, 04 Dec 2025 00:00:00 +0000

source: https://openchainproject.org/news/2025/12/12/recording-openchain-telco-work-group-2025-12-04

일시: 2025년 12월 4일

참석자: Jimmy Ahlberg (Ericsson), Takashi Ninjouji (Honda), Marc-Etienne Vargenau (Nokia)

주요 의제: CycloneDX 이슈, OpenChain 운영진 변경, CISA 규제 현황, 신규 툴 소개, SPDX 3.0 전환 이슈

1. 주요 공지사항 및 운영 이슈

OpenChain General Manager 사임

OpenChain 프로젝트의 핵심 인물이었던 Shane이 General Manager직을 내려놓게 되었습니다. 그의 마지막 근무일은 12월 12일이며, 현재 후임자는 정해지지 않은 상태입니다. 프로젝트 측에서는 적합한 후보자 추천을 환영하고 있으며, 리더십 공백을 최소화하기 위해 노력하고 있습니다.

2025-11-26 대규모 공급망에서 SBOM을 어떻게 운영 단계에 적용할 것인가?

Wed, 26 Nov 2025 00:00:00 +0000

source: https://openchainproject.org/news/2025/11/27/recording-openchain-sbom-work-group-monthly-meeting-2025-11-26

일시: 2025년 11월 26일 (수)

주제: 복잡한 대규모 공급망에서 SBOM을 어떻게 ‘운영(Production)’ 단계에 적용할 것인가?

발표자: Thomas Graf (Siemens)

들어가며: “만드는 것"을 넘어 “쓰는 것"으로

지난 11월 26일 열린 OpenChain SBOM Work Group 정기 미팅은 SBOM(Software Bill of Materials) 논의가 이제 새로운 국면에 접어들었음을 보여주는 중요한 자리였습니다. 그동안 업계의 논의가 “SBOM을 어떻게 생성할 것인가(How to generate)?“에 머물러 있었다면, 이번 미팅의 핵심 질문은 “생성된 SBOM을 실제 운영 환경(Production)과 복잡한 공급망에서 어떻게 활용할 것인가?“였습니다.

2025-11-06 CISA 셧다운의 영향과 SBOM 품질 가이드 집중 점검

Thu, 06 Nov 2025 00:00:00 +0000

source: https://openchainproject.org/news/2025/11/11/telco-2025-11-06

일시: 2025년 11월 6일

참석자: Marc-Etienne Vargenau (Nokia, 의장), Shane Coughlan (OpenChain), Norio Koboto (Sony), Masahiro Daikoku (KDDI), Jari Koivisto (Analog Devices) 등

이번 OpenChain Telco Work Group(이하 Telco WG) 정기 미팅에서는 미국 정부 셧다운이 CISA(사이버보안 및 인프라 보안국)의 업무에 미치는 영향부터, 차기 Telco Guide 업데이트 방향, 그리고 최근 업데이트된 SBOM 품질 가이드(Quality Guide)에 대한 심도 있는 기술적 검토가 이루어졌습니다.

미팅에 직접 참여하지 못하신 분들을 위해 핵심 내용을 상세히 요약해 드립니다.

2025-10-27 SBOM 품질 가이드와 규제 대응의 구체화

Mon, 27 Oct 2025 00:00:00 +0000

source: https://openchainproject.org/news/2025/10/27/recording-openchain-sbom-work-group-monthly-meeting-2025-10-22

작성일: 2025년 10월 27일

주제: OpenChain SBOM Work Group Monthly Meeting (2025-10-22) 상세 리뷰

안녕하세요. 오늘은 지난 10월 22일에 진행된 OpenChain SBOM 워크 그룹(OpenChain SBOM Work Group) 정기 미팅의 핵심 내용을 정리해 드립니다.

이번 미팅은 지난 9월 ‘스터디 그룹(Study Group)‘에서 ‘워크 그룹(Working Group)‘으로 승격된 이후 본격적으로 진행된 논의라는 점에서 큰 의미가 있었습니다. 특히, 현재 업계의 가장 큰 화두인 “단순히 SBOM을 만드는 것을 넘어, 어떻게 고품질의 SBOM을 만들고 규제에 대응할 것인가?“에 대한 구체적인 가이드라인 작업 현황이 공개되었습니다.

2024-12-06 SBOM 가이드라인 업데이트 논의

Fri, 06 Dec 2024 00:00:00 +0000

source: https://openchainproject.org/news/2024/12/12/telco-work-group-2024-12-06

1. 웨비나 개요

발표자 소개

이번 웨비나는 OpenChain Telco Work Group의 정기 미팅으로, Nokia의 오픈소스 전문가가 진행을 맡았습니다.

웨비나 목적

SBOM 관련 최신 기술 가이드라인을 검토하고 OpenChain Telco SBOM 가이드의 개선 방안을 논의하기 위해 개최되었습니다.

2. 인도의 SBOM 기술 가이드라인 검토

가이드라인 개요

Indian Computer Emergency Response Team (CERT-In)에서 2023년 10월에 발표한 SBOM 기술 가이드라인에 대해 논의했습니다. 이 가이드라인은 주로 공공 부문의 보안 관점에 초점을 맞추고 있습니다.

2024-12-05 리눅스 재단에서 SBOM을 활성화하는 과정

Thu, 05 Dec 2024 00:00:00 +0000

source: https://openchainproject.org/news/2024/12/04/webinar-enabling-sboms-across-the-linux-foundation

1. 발표자 소개

Gary O’Neall

Jeff Shapiro

Jeff Shapiro는 리눅스 재단의 라이선스 스캐닝 디렉터로, 30년 이상의 소프트웨어 산업 경험을 보유하고 있습니다. 그는 오픈소스 스캐닝 및 OSS(오픈소스 소프트웨어) 라이선스 준수 교육에 전문성을 가지고 있으며, 현재 리눅스 재단에서 중요한 프로젝트들의 코드 관리와 SBOM 생성에 기여하고 있습니다.

2024-11-27 취약점과 미래 - 다층적 소프트웨어 취약점과 대응 전략

Wed, 27 Nov 2024 00:00:00 +0000

source: https://openchainproject.org/news/2024/12/04/sbom-study-group-2024-11-27

1. 소개

이 블로그 포스트는 OpenChain Project의 SBOM Study Group 웨비나에서 발표된 “취약점과 미래 - 다층적 소프트웨어 취약점과 대응 전략"에 대한 내용을 다룹니다. 이 웨비나는 소프트웨어 공급망 보안과 취약점 관리의 중요성을 강조하며, 현재의 도전과제와 미래의 전략을 탐구합니다.

2. 발표자 소개

발표자인 Okada San은 OWASP Japan의 전문가로, 일본 기업에서 애플리케이션 보안 강화와 소프트웨어 생산성 팀을 지원하는 보안 연구원입니다. OWASP 재단의 평생 회원으로, 20년 이상 다양한 문서 번역 작업에 참여해 왔습니다.

2024-10-29 SBOM 관련 다양한 규제와 가이드라인에 대한 개요

Tue, 29 Oct 2024 00:00:00 +0000

source: https://openchainproject.org/news/2024/10/29/openchain-sbom-study-group-october-2024-10-23-full-recording

1. 세미나 개요

제목

OpenChain SBOM 스터디 그룹 - 2024년 10월 세미나

발표자 소개

이번 세미나의 발표자는 도시바의 Ninjouji-san입니다. 도시바는 일본의 대표적인 다국적 전자 기업으로, 오픈소스 및 SBOM 관련 분야에서 풍부한 경험을 보유하고 있습니다.

웨비나 소개와 목적

이번 OpenChain SBOM 스터디 그룹 세미나는 다양한 규제와 가이드라인에 대한 개요를 제공하고, 향후 미팅에서 필요한 사항들에 대해 논의하는 것을 목적으로 합니다. SBOM(Software Bill of Materials)은 소프트웨어 구성 요소를 투명하게 관리하고 보안 취약점을 효과적으로 대응하기 위한 중요한 도구로 주목받고 있습니다.

2024-10-29 SBOM 시각화 - SBOM 검토를 위한 대안적 접근법

Tue, 29 Oct 2024 00:00:00 +0000

source: https://openchainproject.org/news/2024/10/29/webinar-sbom-visualization

1. 소개

발표자 소개

이번 웨비나의 발표자는 Bitsea GmbH의 창립자이자 CEO인 Andreas Kotulla 박사입니다. Andreas 박사는 소프트웨어 시스템 감사와 기업의 숨겨진 위험 식별 분야의 전문가입니다. 그는 기술 실사를 지원하고 주요 기반 시설(KRITIS) 운영자들에게 조언을 제공합니다. 또한 오픈소스 전략, 거버넌스, 프로세스, 툴체인에 대해 고객들에게 자문을 제공하며, 오픈소스 프로그램 오피스(OSPO) 및 스캐닝 관리 서비스를 제공합니다.

2024-07-30 킥오프 웨비나: SBOM의 실제 활용 방안 모색

Tue, 30 Jul 2024 00:00:00 +0000

source: https://www.slideshare.net/slideshow/openchain-sbom-study-group-kick-off-call-2024-07-30/270623321

1. 웨비나 소개

제목

OpenChain SBOM Study Group 킥오프 웨비나

발표자 소개

Shane Coughlan: OpenChain 프로젝트 총괄 매니저
Kate Stewart: Linux Foundation의 오픈소스 기술 부사장
Kobota San: Sony에서 근무하며, 2024년 SBOM Study Group의 의장

웨비나 소개와 목적

이 웨비나는 OpenChain 프로젝트의 새로운 SBOM Study Group의 킥오프 미팅입니다. 주요 목적은 대규모 및 복잡한 공급망에서 SBOM(Software Bill of Materials)을 실제로 어떻게 활용할 수 있는지에 대한 논의를 시작하는 것입니다. 이를 통해 SBOM의 실용적인 적용 방안과 공급망 내에서의 신뢰 구축 방법을 모색하고자 합니다.

SBOM on OpenChain KWG

OSV-SCALIBR

1. Features

2. Installation

cdxgen

Features

Installation

Syft

Features

Installation

Script Installation (Linux/macOS)

Homebrew (macOS)

Docker

Basic Usage

(1) Scan a Container Image

(2) Scan a Local Directory

(3) View Results in Terminal

(4) Vulnerability Scanning with Grype

CI/CD Integration Example

References

Dependency-Track

Features

Installation

Building an Automated Open Source Management Environment: cdxgen + Dependency-Track

Why cdxgen + Dependency-Track

SCANOSS

1. Key features

2. Installation

§3.3.1 SBOM

1. Clause Overview

§4.3.1 SBOM

1. Clause Overview

TRUSCA

28th Meeting

Schedule

Agenda

Sponsor

31st Meeting

Software Supply Chain Security and Open Source Governance

CISA 2026 SBOM Minimum Elements: What to Prepare and Which Tools Fill the Gaps

Summary

What the US AI Executive Order (2026-06-02) Means for Enterprise Open Source Managers

EU Cyber Resilience Act (CRA) Vulnerability Reporting Obligations — A Research Report for the 2026-09-11 Compliance Date

2025-12-04 SBOM 표준화와 최신 이슈들

1. 주요 공지사항 및 운영 이슈

OpenChain General Manager 사임

2025-11-26 대규모 공급망에서 SBOM을 어떻게 운영 단계에 적용할 것인가?

들어가며: “만드는 것"을 넘어 “쓰는 것"으로

2025-11-06 CISA 셧다운의 영향과 SBOM 품질 가이드 집중 점검

2025-10-27 SBOM 품질 가이드와 규제 대응의 구체화

2024-12-06 SBOM 가이드라인 업데이트 논의

목차

1. 웨비나 개요

발표자 소개

웨비나 목적

2. 인도의 SBOM 기술 가이드라인 검토

가이드라인 개요

2024-12-05 리눅스 재단에서 SBOM을 활성화하는 과정

목차

1. 발표자 소개

Gary O’Neall

Jeff Shapiro

2024-11-27 취약점과 미래 - 다층적 소프트웨어 취약점과 대응 전략

목차

1. 소개

2. 발표자 소개

2024-10-29 SBOM 관련 다양한 규제와 가이드라인에 대한 개요

목차

1. 세미나 개요

제목

발표자 소개

웨비나 소개와 목적

2024-10-29 SBOM 시각화 - SBOM 검토를 위한 대안적 접근법

목차

1. 소개

발표자 소개

2024-07-30 킥오프 웨비나: SBOM의 실제 활용 방안 모색

목차

1. 웨비나 소개

제목