Download to read offline
Open Source SecurityCon 2025 in Atlanta - Transparency Exchange API: Where To Find Product SBOM?
- 1. Where to Find ProductSBOM? *IANAL (Not a Legal Advice!)
- 2. My Previous Talkson TEA and This Slide Deck BSides Toronto Talk OWASP Deck This Deck
- 3. EU CRA Introduction,p.22 EU CRA Introduction, p.60 EU CRA Chapter II, Article 13, p.13
- 4. SBOM Management BOM 1.SBOMs created and stored as part of SDLC (CI/CD) 2. SBOMs mapped to releases 3. Trust point - authoritative domain name 4. Release identities for your releases
- 5.
- 6. 1.0.0 1.0.1 1.1.0 WhereTraditional SCA Breaks SCA is Done Somewhere Here
- 7. SCA is Done SomewhereHere With SBOM Generation Same with SBOM Repeat Every X Days
- 8.
- 9. The only wellestablished system exists for individual container images on OCI storage
- 10. Product - ComponentData Model Apache Log4j Log4j v2.25.1 Product Product Release Log4j Core Component Log4j v2.25.0 Log4j API Log4j Core v2.25.1 Log4j Core v2.25.0 Log4j API v2.25.1 Log4j API v2.25.0 Component Release
- 11. Releases and Collectionsof Artifacts Release Source Code Level SBOM Container Level SBOM Collection v2 Source Code Level SBOM Collection v1
- 12. Most Accurate Datais Only Available Upstream
- 13. API is theFuture of Transparency CycloneDX 2.0 Expected to Have API Version
- 14. for some TEA? Ifyour SBOM management is CRA ready, it is TEA ready. More so, TEA may act as a framework for readiness towards other frameworks.
- 15. Transparency Exchange API API-first(TEA is an API) Decentralized TEI-based Discovery Product-Component Model Release-Collection Model CLE / EoX Insights
- 16. TEA Server Management 1.Self-Hosted 2. Managed by TEA Service Provider Domain Always Belongs to Self!
- 17. Discovery via TEI TEI ProductRelease urn:tei:<type>:<domain-name>:<unique-identifier> urn:tei:purl:cyclonedx.org:pkg:pypi/[email protected] UUID PURL SWID HASH EAN/UPC UDI GTIN ASIN Known Types:
- 19. Demo TEA Flow- Apache Log4j2 urn:tei:purl:oolong-demo.rearmhq.com:pkg:maven/org.apache.logging.log4j/[email protected] urn:tei:uuid:oolong-demo.rearmhq.com:ff08fa6a-1df9-4ab7-b3ec-e02837845a06 urn:tei:purl:oolong-demo.rearmhq.com:pkg:github/apache/logging-log4j2
- 20.
- 21. Get Inovled andReferences https://github.com/CycloneDX/transparency-exchange-api/ https://cyclonedx.org/slack/invite https://cyclonedx.org/participate/contribute/ https://tc54.org/tea/ https://openssf.org/resources/improving-risk-management-decisions-with-sbom-data/ https://www.cisa.gov/sites/default/files/2025-09/joint-guidance-a-shared-vision-of- software-bill-of-materials-for-cybersecurity_508c.pdf https://github.com/relizaio/oolong https://www.youtube.com/watch?v=MjVQZxFENQI
- 22. Thank you! I’mPavel Shukhman Startup Founder Building ReARM - Open Core xBOM tool TEA Contributor, participant of OpenSSF SBOM groups Avid Traveler *IANAL (Not a Legal Advice!)