You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: marketing/content/blog/sbom_creators_and_consumers.md
+14-9Lines changed: 14 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,27 +11,32 @@ SBOMs are a critical tool for understanding your software supply chain. But not
11
11
There are ๐ฐ๐ฟ๐ฒ๐ฎ๐๐ผ๐ฟ๐ and there are ๐ฐ๐ผ๐ป๐๐๐บ๐ฒ๐ฟ๐. Sometimes they're the same person, but often they're not.
12
12
13
13
๐ฉ๐ปโ๐ป ๐๐ฟ๐ฒ๐ฎ๐๐ผ๐ฟ๐
14
+
14
15
These folks generate SBOMs as part of the software build or packaging process:
15
-
๐ป Development teams
16
-
โ๏ธ CI/CD pipelines
17
-
๐ฆ Software vendors
18
-
๐ ๏ธ Tooling platforms
16
+
17
+
* ๐ป Development teams
18
+
* โ๏ธ CI/CD pipelines
19
+
* ๐ฆ Software vendors
20
+
* ๐ ๏ธ Tooling platforms
19
21
20
22
๐ฏ Their job: Ensure SBOMs are accurate, complete and reflect the actual software build artifacts.
If you're a ๐ฐ๐ฟ๐ฒ๐ฎ๐๐ผ๐ฟ, you're responsible for ๐๐ฟ๐๐๐ต.
39
+
35
40
If you're a ๐ฐ๐ผ๐ป๐๐๐บ๐ฒ๐ฟ, you're responsible for ๐๐ฟ๐๐๐.
36
41
37
42
This is why signing SBOMs and supporting cryptographic digital verification is critical. Without that, you might be consuming... misinformation? ๐คทโโ๏ธ
0 commit comments