The second presentation overlapped slightly with the first, but emphasized the tooling aspect:

• #SBOM lifecycle and blueprint
• Our modular SBOM toolchain for generation, refinement, analysis and storage
• Integration into DevOps workflows
• Our central compliance portal for teams and governance owners
• And how we delight our various users.

This is all heavily based on many great open-source projects, such as those by @anchore@mastodon.business and @homebrew.

https://mehl.mx/blog/2026/deutsche-bahns-approach-to-large-scale-sbom-collection-and-use/

[🧵 3/3]

I recently presented Deutsche Bahn's ongoing efforts to make its software supply chains more transparent. For the first time, we publicly shared how we set up the internal program, the principles we follow, the overarching architectural blueprint, and the tools we use to create, store, and analyze 80,000+ SBOMs. All of this is to find out, in real time, which of the over 100,000 software components we are using are where and how. [🧵 1/3]

#DeutscheBahn #SBOM #SupplyChain #CRA #NIS2

We’ve published a new blog post outlining how we’re preparing for the European Union’s Cyber Resilience Act (CRA), and what it means for the FreeBSD ecosystem.

The CRA introduces new compliance expectations for products containing digital elements, including open source components.

Read the full post here:
https://freebsdfoundation.org/blog/getting-ready-for-the-cyber-resilience-act/

#FreeBSD #OpenSource #Security #Compliance #SBOM