June 2026 Go Meetup
Meetup #86 on June 17 in person at Edmonton Unlimited at 6:00 pm.
Please RSVP at Meetup
News
Agenda
Software Bill of Materials (SBOM): What it Is? Why Does it Matter?
Peter Preeper gave a talk on the Software Bill of Materials: what it is, why it exists, and why it matters. An SBOM is a formal, machine-readable inventory of every component used to build a software artifact — like an ingredients label — recording name, version, license, supplier, dependency relationships, checksums, and known vulnerabilities. He traced the supply chain attack crisis from SolarWinds and Log4Shell through CodeCov, node-ipc, 3CX, XZ Utils, Bybit, and 2026's npm worm and DAEMON Tools backdoor, showing how SBOMs turn slow zero-day inventory from weeks into minutes of grep. The talk covered vulnerability monitoring, license compliance, and regulatory mandates (US EO 14028, CISA, the EU Cyber Resilience Act), then went deep on SPDX vs CycloneDX vs SWID and Go's built-in support. He finished with practical tooling — Syft, Grype, govulncheck, and cyclonedx-gomod — and a CI/CD pipeline.
Key points:
- An SBOM is a machine-readable inventory of an artifact's components.
- It records name, version, license, supplier, dependencies, hashes, and CVEs.
- Supply chain attacks (Log4Shell, SolarWinds, XZ Utils) drove adoption.
- SBOMs speed zero-day response and enable continuous vulnerability scanning.
- Regulation is pushing them: US EO 14028, CISA, EU Cyber Resilience Act.
- SPDX is license-first (ISO), CycloneDX is security-first (OWASP), SWID targets asset management.
- Go has SBOM support built in:
go.mod,go.sum,go version -m,debug/buildinfo, andgovulncheck.
Open Table
Open table discussion.
Events
- Edmonton Go Meetup September