Comparison
Software bill of materialsvsSoftware supply chain
Software bill of materials
a vulnerability was announced on a Friday and you answered 'are we affected' from a file rather than from a week of grepping.
A machine-readable inventory of every component and version inside an artefact, generated at build time. Its value is almost entirely retrospective: when the next widely-exploited library lands, the question is which of four hundred deployed images contain it, and an SBOM turns that from an archaeology project into a query. It is increasingly a procurement requirement as well, which is usually what finally gets one generated.
Full entry →Software supply chain
your artefact contains code from four hundred projects you have never read and a build system nobody has audited.
Everything that contributes to a released artefact: dependencies, base images, build tools, the pipeline itself and the people with access to any of them. Attacks target it because compromising one widely-used link reaches everyone downstream, and because it is much less defended than production. The defences are dull and effective — pin versions, verify what you pull, build hermetically, sign what you publish, and know what is inside.
Full entry →