Recent searches

No recent searches

Search options

Only available when logged in.
mastodon.gamedev.place is one of the many independent Mastodon servers you can use to participate in the fediverse.
Mastodon server focused on game development and related topics.

Administered by:

Server stats:

4.8K
active users

mastodon.gamedev.place: AboutProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.4.2

#SBOM

0 posts0 participants0 posts today
Syft

UV got you down? Not anymore! 🥳 Syft now supports Python uv.lock files, thanks to awesome community work. Get your latest SBOMs! #Syft #SBOM #Python anchorecommunity.discourse.gro

Anchore Community · Anchore Open Source Weekly Report - Week 29, 2025This report covers the community activity in Anchore Open Source Projects from July 14, 2025 to July 18, 2025. Executive Summary The Anchore Open Source ecosystem delivered strong progress this week with 22 issues and pull requests successfully resolved across the project portfolio. A standout achievement was the long-awaited integration of Python UV lock file support in Syft, fulfilling a community request that had been in development for several months. The team also prioritized security infr...
Patrick Masson

Thank you to Mary Grush of Campus Technology magazine for her interest in @apereo and the resurgence of #OpenSource in #HigherEd.

While institutions of #HigherEducation are now more dependent on #OSS than ever, their engagement with and support of both the projects and communities may be at an all-time low.

Several factors should prompt greater participation from campus leadership and IT departments: #SBOM, #CRA, the rise of academic #OSPO, grant/funding requirements (#OpenScience), etc.

Replied in thread
Bradley Kuhn

@bagder wrote:
> I think of SBOMs as a way for us to charge

So does the Compliance Industrial Complex. They've been planning for this. 💰's on the table when make-work becomes mandatory regulation.

I doubt small FOSS business'll get a piece of that pie easily. #SBOM game is already rigged to favor Big Tech.

But, I hope I'm wrong & you make a living from it!

Let's reserve the right to “I told you so” each other when one of us turns out wrong in 5-10 years. ☺

Cc: @msw @lexelas
@jeremiah_

Replied in thread
Bradley Kuhn

@bagder
Oh, I agree: confused users will request #SBOM's b/c they think they're useful (… even though they aren't).

My point is: we're still at a moment where we can influence actual implementation of CRA in practice (regulations are being written now).

The best approach? Convince regulators that complete, corresponding source &
@reproducible_builds are *actually* useful to customers for FOSS.

#SBOM's are only useful for proprietary software. SBOMs for FOSS is make-work.

Cc: @msw @lexelas

Replied in thread
*
Bradley Kuhn

@bagder Thanks for your post & your counter 😆

I'm curious: you characterize the EU #CRA as requiring #SBOM's *specifically*. I know the License Compliance Industrial Complex wants it to be true, but I researched this issue for my #FOSDEM 2025 talk…
fosdem.org/2025/schedule/event
… & IIUC CRA *doesn't* specify SBOMs specifically.
IMO, if the vendor gives the customer complete, Corresponding Source & a 100% @reproducible_builds they've complied with CRA. No one has shown me anything that disproves that.

fosdem.orgFOSDEM 2025 - Is There Really an SBOM Mandate?
Josh Bressers

I chatted with Philippe Ombredanne about Package URLs, or PURLs. He created them, so he knows a thing or two.

We do complain about CPE quite a bit :)

But it's a really hard problem. It feels like a package identifier should be easy, but it's way harder than you think it is. There's nobody better than Philippe to drop some knowledge.

opensourcesecurity.io/2025/202

#PURL
#CVE
#SBOM

Open Source Security · Package URLs with Philippe OmbredanneI’m joined by Philippe Ombredanne, creator of the Package URL (PURL), to discuss the surprisingly complex and messy problem of simply identifying open source software packages. We dive into how PURLs provide a universal, common-sense standard that is becoming essential for the future of SBOMs and securing the software supply chain. Episode Links Philippe AboutCode PURL AI-Generated Code Search This episode is also available as a podcast, search for “Open Source Security” on your favorite podcast player.
Prof. Dr. Dennis-Kenji Kipker

Wenn #Cybersecurity genauso wichtig ist wie die Außenpolitik: Cyberbedrohungen machen genauso wenig wie die globalen Datenströme an den Staatsgrenzen Halt - deshalb gehört die #Cybersicherheit beim #G7-Gipfel mittlerweile genauso dazu wie die Außen- und Wirtschaftspolitik.

Dies haben die Leiter der Cybersicherheitsbehörden der G7-Staaten nun zum Anlass genommen, ein gemeinsames Konzept für eine #SBOM (Software Bill of Materials) für #KI-Systeme zu veröffentlichen:

bsi.bund.de/DE/Service-Navi/Pr

Benjamin Carr, Ph.D. 👨🏻‍💻🧬

Trump quietly throws out Biden-era #cyber #policies
Following Biden-era programs is now out or significantly rolled back:
- Requirement for federal #software vendors provide #SBOM gone
- Several #AI #cybersecurity research mandates, have been scrapped or deprioritized.
- Requirement that software contractors formally attest they followed secure development practices has been cut. Instead, #NIST will now coordinate a new industry consortium to review security guidelines.
axios.com/2025/06/10/trump-exe

Axios · Trump quietly throws out Biden's cyber policiesBy Sam Sabin
Mike Dolan

"The Microsoft #opensource #SBOM Tool now supports hashtag #SPDX 3.0!"

linkedin.com/posts/adriandigli #cybersecurity

www.linkedin.comGitHub - microsoft/sbom-tool: The SBOM tool is a highly scalable and… | Adrian DiglioThe #Microsoft #opensource #SBOM Tool now supports #SPDX 3.0! Huge kudos to John Wade and team for the work they've done to make this possible. Today, the tool still produces SPDX 2.2 by default unless the user specifies the following flag: -mi SPDX:3.0 The SBOM Tool currently supports the SPDX 3.0 models for Core, Software, and Licensing. This is something my previous team was working on, and I was excited to see it get completed! https://lnkd.in/g3gjswxv #supplychainsecurity
TrendingLive feeds
About