FOSDEM 2024 devroom proposal

Full proposal content:

Proposal title:

Software Bill of Materials devroom

Notes:

After the success of last year's first-ever SBOM devroom, we want to host it again in 2024. Last year we initially had a half-day, but it got extended to a full-day. The number of submissions we received in our CfP was enough to cover almost double the time allocated! We ran almost the whole day in full room capacity.

Language:

en

Why does this proposal fit FOSDEM:

Having a Bill of Material for software deliveries is becoming more and more important, or even crucial. Security and regulatory obligations require both producers and consumers of software to have a complete and accurate knowledge of all components in a software package. Besides the well-known and understood problem of listing software components and their metadata, the field of Software Bill of Materials is facing new challenges. A new type of software (commonly referred to as "AI"-related) emerges, that is built not only from source code, but also from processing of datasets. There is, therefore need to record what datasets were used, how the processing was done, and so on. The field is very much open right now and lots of people/teams are working on these issues, both from the requirements/standardization side and the implementation/tools side.
We believe that open discussion on all these aspects is important for the Free Software community and FOSDEM provides a perfect venue for it. The success of last year's first-ever SBOM devroom attests to the high interest of both presenters and audience.

Prefered slot:

Full day (any)

Submitters affinity to the topic:

I was one of the people involved with running the same SBOM in 2023; my co-organizers have also indicated that they are willing to serve again. I have been deeply involved in SBOM topics for more than a dozen years, both as a volunteer and as an employee. I work with implementing such infrastructure in Intel. I am also part of the SPDX Steering Committe, its Technical and Legal teams, and I co-chair its Outreach team (SPDX being an international standard for SBOMs). I also participate in numerous other efforts related to SBOMs (e.g. OpenSSF, OpenChain, etc.)

Relevant URLS:

https://archive.fosdem.org/2023/schedule/track/software_bill_of_materials/ https://spdx.dev/

Special Requirements:

None