SBOM as an operational input — incident response, license audit, dependency change

The SBOM is the inventory of the deployed artifact. The inventory is consumed by three operations beyond vulnerability matching: incident response (what was in the artifact that failed), license audit (does the artifact comply with policy), and dependency change (what the next build will introduce).

Incident response, license audit, dependency change

A production incident triggered a rollback. The team needs to answer: what was in the failed artifact that is not in the last known-good? The answer requires a diff:

syft diff sbom.known-good.spdx.json sbom.failed.spdx.json

The diff command outputs the components added, removed, and changed. The output is the candidate root-cause list: the packages that landed in the failed build but not in the known-good.

flowchart LR
    A["Known-good SBOM"] --> C["syft diff"]
    B["Failed SBOM"] --> C
    C --> D["Added"]
    C --> E["Removed"]
    C --> F["Changed"]
    D --> G["Candidate root cause"]
    E --> G
    F --> G

Many organisations have an OSS license policy. The SBOM is the input to the audit; the matcher compares the SBOM’s license fields against the policy. The audit pipeline: pull the SBOM from the attestation, extract the license fields, compare against the policy list, emit a per-component decision, and aggregate to the artifact-level decision.

The dependency-change diff is the third operational use: the team proposes a dependency upgrade and asks “what else moves when we upgrade this package?”

syft diff sbom.before.spdx.json sbom.after.spdx.json

The diff shows the transitive movement. Generate the after-SBOM in a PR build, review the diff before merging, and track the dependency-change history.

Production discipline

1. Persist SBOMs by digest with a long retention window. The SBOM is the audit trail.
2. Index an SBOM diff tool against the SBOM store (the diff is the incident-response primary tool) and run the license audit on every build.
3. Block the deploy on non-compliance.

Cross-course references

• Git, CI/CD & GitOps — Part LXVIII-04 (SBOM Distribution and Attestation) is the durable binding that makes the operational queries possible.

Quiz