News
This Week in SBOMs: OpenSSH's musl Hole, APT Swaps Packages, and the CRA Reporting Platform Hits v1.3
This is the third issue of This Week in SBOMs, covering Saturday 31 October to Friday 6 November 2026. Last week was about finding PHP and...
News
This Week in SBOMs: PHP2Shell Goes Live, Brotli Hides Behind Version Numbers, and Alpine's GitLab Scare
Welcome to the second issue of This Week in SBOMs, marking the first time we cover a standard seven-day period: Saturday 24 October to...
News
This Week in SBOMs: PHP2Shell, a Wave of Poisoned Releases, ENISA's SBOM Advisory and Germany's CRA Law
Welcome to the inaugural This Week in SBOMs, a weekly survey of developments within software security, regulation and standards, viewed...
Announcement
Announcing sbomify v26.9.0: The One That Speaks SPDX 3
If you generate SBOMs from an embedded Linux build, you have probably had a version of this experience with us: the document uploads,...
Announcement
Announcing sbomify-action v26.9.0: The One That Runs on Every CI
The action has always claimed to work on any CI system. That was true in the sense that it ran, and false in every sense that matters once...
Guide
SPDX 3.0 in Yocto: What Changed and Why It Matters
SPDX 3.0 support was added in the Styhead release (Yocto 5.1) and represents a significant architectural leap. The implementation lives in...
Guide
A Deep Dive into Yocto's SPDX 2.2 Pipeline
The SPDX 2.2 implementation in the Yocto Project has been stable since the Honister release (Yocto 3.4, October 2021). It is the...
Guide
How Yocto Generates SBOMs Behind the Scenes: A Deep Dive into SPDX 2.2 and SPDX 3.0
If you are building embedded Linux products with the Yocto Project, you are sitting on one of the most mature and sophisticated SBOM...
Education
PEP 770: SBOMs Are Now a First-Class Citizen in Python Packages
Python now has an official standard for shipping SBOMs inside packages. PEP 770, authored by Seth Larson (Python Security...
Announcement
Announcing sbomify-action v0.14: The One With Yocto
What started as github-action has outgrown its name. With v0.14, we are officially renaming the project to sbomify-action to reflect what it...
Education
Why We're Bullish on TEA, And Why You Should Be Too
Imagine you’re standing in an electronics store, holding a product in your hand. Using a TEA app, you could automatically scan the...
Announcement
Announcing sbomify v0.27: The One with TEA
We have been working towards this release for a while. sbomify v0.27 brings full Transparency Exchange API (TEA) support, SPDX 3.0...