SBOM
-
AWS open source newsletter #170
Aug 21, 2023 | 21 minute read
August 21st, 2023 - Instalment #170 Welcome to edition #170 of the AWS open source newsletter, an oasis of open source goodness that features the latest new projects, essential reading, and must view videos to quench the thirst of every open source developer. This weeks edition we have new projects that help you get on top of your IAM actions, a handy tool for knowing what your current AWS account service limits are from the command line, a tool to help you do database migrations, and some interesting and very detailed reference solutions for gaming, live streaming, and managing/exporting of your Amazon Cognito profiles.
- oss-newsletter
- aws open source
- AWS-LC
- Threat Composer
- AWS CDK
- AWS SAM
- AWS SDK for Java
- GitLab
- GraphQL
- AWS AppSync
- AWS Distro for OpenTelemetry (ADOT)
- PostgreSQL
- Apache Airflow
- SBOM
- Syft
- Apache Hudi
- Apache Iceberg
- Apache Spark
- collectd
- Grafana
- O3DE
- ROS
- Next.js
- PostgreSQL
- OpenZFS
- MWAA
- Cedar
- Powertools for Lambda
-
sbomqs, an open source tool to quality check your SBOMS
Feb 2, 2023 | 6 minute read
When putting together a previous post on how to use open source tools to create a software bill of materials (SBOM), Ritesh Noronha alerted me to another project, sbomqs that aims to simplify the evaluation of SBOM quality for both producers and consumers. A quality SBOM is one that is accurate, complete, and up-to-date. It should accurately reflect the components and dependencies used in the software application, including their version and optionally any known vulnerabilities.
-
Building a software bill of materials (SBOM) using open source tools
Feb 1, 2023 | 6 minute read
This is the second post exploring how you can use open source tools to help you build a stronger defence against common software supply chain attacks. In this blog post, I look at syft, an open source CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. We will use examples and build on the previous post, Getting hands on with Sigstore Cosign on AWS.