The InfoQ Podcast

How SBOMs and Engineering Discipline Can Help You Avoid Trivy’s Compromise

17 snips
Apr 13, 2026
Guest
Viktor Pettersson
Viktor Pettersson, co-founder of sbomify and CISA SBOM contributor, helps teams navigate SBOMs, CRA compliance, and supply chain safety. He discusses why SBOMs are operational tools not just paperwork. He covers CI generation and signing, TEA for vendor-neutral discovery, ecosystem-specific tooling, and lessons from the Trivy compromise.
Ask episode
AI Snips
Chapters
Transcript
Episode notes
INSIGHT

CRA Will Make SBOMs Mandatory For Interneted Products

  • The EU Cyber Resilience Act will force most products that connect to the internet to provide SBOMs, effectively creating a GDPR-like regulatory moment for software supply chains.
  • Viktor Pettersson warns noncompliance can block products from the European market, a stronger incentive than fines and likely unknown to many vendors.
ADVICE

Use SBOMs As An Operational Security Tool

  • Use SBOMs operationally, not just for compliance, to run automated security and license audits and to diff releases over time.
  • Leverage VEX statements to mark CVEs as non-impacting when specific functions aren't used, avoiding blind upgrade churn.
ADVICE

Capture Dependencies From CI Logs And Better Package Managers

  • Start your SBOM journey by capturing high-quality build log files in CI so you have an accurate inventory of application dependencies.
  • Migrate to modern package managers (e.g., pipenv/poetry, bun/uvm) to generate better lockfiles and transitive dependency capture.
Get the Snipd Podcast app to discover more snips from this episode
Get the app