SBOM-Driven License Compliance

▶ Watch (03:39)

The team uses Gradle’s CycloneDX plugin to generate SBOMs in CycloneDX format. These land in Dependency Track, where legal configures a license policy once. Policy violations surface in a tab, triggering GitHub issues automatically via the Dependency Track API. This replaces the email-and-spreadsheet process Thomas described: company-approved request template, manual component listing, unique approval IDs. One legal review propagates to all projects instantly.

CVE Triage: Context Over Zero

▶ Watch (08:40)

Zero CVEs is a bad target. Thomas points to Daniel Stenberg, curl’s maintainer, who published a list of AI-generated junk CVE reports, including one claiming curl is vulnerable because its source code is open. A reported CVE attached to a library does not mean the application is exploitable. Dependency Track shows policy violations, lets teams document their assessment inline, and Renovate auto-opens a pull request when a patched version ships.

Git Has No Authentication: Commit Signing and SLSA

▶ Watch (17:46)

Git stores committer name and email as plain config. Thomas demos this by pushing a commit under Alexandra’s name, which GitHub accepts without question. The fix: git commit -S (uppercase S) to sign with an SSH key. GitHub marks the commit unverified if the key does not match. Beyond commits, cosign signs container images, and a one-line GitHub Actions step appends SLSA attestations recording the exact commit, build workflow, and build summary. No Confluence page needed.

Crossplane and Backstage: Compliance Without the Cognitive Load

▶ Watch (27:08)

Replacing manual checklists with a dozen new tools still shifts the toil. Crossplane solves that. The platform team defines a Kubernetes API where developers supply only the application name, image, and service integrations. SBOM generation, license checks, and image signing run automatically. Kyverno policies on the cluster block any image without valid SLSA attestations from ever reaching production. A Backstage template bootstraps every new project with this pipeline already wired in.

Notable Quotes

Git doesn’t have the concept of authentication. Thomas Vitale · ▶ 17:46

so we cannot fully trust CVS they are an indicator that something might be wrong Thomas Vitale · ▶ 09:50

Key Takeaways

  • Generate SBOMs with CycloneDX plugins; feed them into Dependency Track for automated license and CVE policy checks.
  • A CVE against a library does not mean your app is exploitable; document your assessment in Dependency Track.
  • Git commit identity is unauthenticated by default; enforce signed commits with git commit -S and verify in GitHub.
  • Cosign and SLSA attestations prove a container image traces to a specific signed commit and pipeline run.
  • Crossplane and Backstage templates turn compliance into a platform service; developers supply app name and image, nothing else.

About the Speaker(s)

Thomas Vitale is a Senior Software Architect at Systematic, a Danish software company. He is the author of “Cloud Native Spring in Action” and co-author of “Developer Experience on Kubernetes.” Thomas created the Aronia project for Java applications.

Alexandra Hou Aldershaab is a DevOps Consultant at Eficode. She is an advocate for Developer Experience, active in the Developer Experience TAG, and has worked through diverse legacy environments across her career.