SBOMs Aren't Enough. Secure Your Software Supply Chain End-To-End

Overview: Software Bill of Materials (SBOMs) have emerged as a critical component of software supply chain security, promising transparency about the dependencies in our applications. But are they delivering on that promise? While SBOMs provide a snapshot of the components included in software, they often fail to address a vital piece of the puzzle: the tools, libraries, and configurations actually used to build it. In this talk, we explore the varying degrees of SBOM quality and expose the gaps that can

Key Topics: undermine their utility. By understanding what SBOMs are—and what they are not—we uncover the risks of relying on incomplete or inaccurate data and discuss complementary strategies for achieving a truly transparent and secure build process, covering OpenSSF projects including in-toto, SLSA, sigstore, TUF, and git-policy enforcement.