SOSS Fusion 2024

Software Bill of Materials (SBOMs) have become essential for ensuring transparency, security, and compliance. However, many end users find the current state of SBOMs challenging, with issues like inconsistent formats, lack of real-world guidance, and sparse tooling. The reality is that regulations requiring SBOMs can often be satisfied with an empty JSON file or a handwritten word document that the recipient doesn't really know what to do with. Despite these challenges, SBOMs hold significant promise for enhancing software security. This talk will highlight ongoing efforts to improve SBOM practices, emphasizing the importance of collaboration among specification designers, regulators, and developers. We'll explore how OpenSSF projects like Protobom and bomctl are attempting to provide a foundation for the tooling end users need. By focusing on these initiatives and promoting best practices, we can work towards a future where SBOMs are not just regulatory checkboxes, but powerful tools for software management and security.