Skip to content
Snippets Groups Projects
Sheogorath's avatar
Sheogorath authored
After running it for a while now, it turns to be not too useful for the
SI Infra. The main use-cases for SBOMs at this point are security scans
and license compliance.

None of these are use-cases that I actually used the produced SBOMs for.

One of the main issues for using these SBOMs for security scans was the
glaring false-negatives for actual security issues due to a lack of
detection of certain packages/application within containers.

Instead running renovate and regularly upgrading all parts has proven
way more practical.

License Compliance, while might being a potential concern, is not on the
list of things to worry about right now.

Finally another issue with this particular operator, was it breaking for
various reasons and resulting in dropping out regularly, which made
SBOMs also out of date.
77f29c1c
History
Name Last commit Last update
..
base
k8s01