The Growing Importance of Software Bills of Materials  ## Metadata - Author: [[The Open Source Way]] - Full Title: The Growing Importance of Software Bills of Materials - Category: #podcasts - URL: https://share.snipd.com/episode/5af0478f-1f1e-48aa-89cc-66fccbc342a4 ## Document Notes ## Highlights - Episode AI notes 1. Open source software component usages come with legal obligations, so a full list of components including metadata is necessary. S-Bombs provide a full list of components and metadata. Open source tools can be used to create S-Bombs. 2. S-Bombs help improve open source management and answer important questions about usage and resource allocation. They can also help allocate resources for open source management. 3. There are a lot of open source component usages in software products. Open source software components come with legal obligations. ([Time 0:00:00](https://share.snipd.com/episode-takeaways/d5f14fe4-47d9-4a75-80bf-099567da370d)) - The Relevance of Software Bills of Materials (SBOMs) in Open Source Open source software component usages come with legal obligations, so a full list of components including metadata is necessary. Open source tools can be used to create an S-Bomb and manage the metadata. S-Bombs help improve open source management and answer important questions about usage and resource allocation. Transcript: Speaker 3 Okay, I see. But what again is the particular relevance to open source? I mean, the Bastian, we do have a system, the TPMS, that takes care of things like that internally at SAP. What's the specific relevance to open source? Speaker 2 Yeah, so open source is pretty much everywhere when it comes to to S-Bomb handling and there are two main dimensions to it, right? The first and probably most important one is that there are a lot of open source component usages as we also see in this internal system. And it's probably not only the case at SAP but across the whole industry, virtually all software products either contain open source software these days or touch it to a certain extent. So we need to handle these open source software component usages and why is that the case? That's pretty simple. Visually all open source software components come with certain legal obligations. So it's not a, let's say, optional thing but it's a mandatory thing from a legal perspective by law. So we need, for example, to give credit to the original authors. We need to check which license obligations we have, what we can do with the software and so on and so on. So to be able to fulfill all of these requirements and to manage them properly, you need to get a full list of components including and that's very important including all the metadata. And this pretty much is this S-Bomb. So it's both a combination between a commercial and open source component usages. The second dimension is of course that you can use open source tools and services to create an S-Bomb to do this management of this metadata. So there's for example, this open source revenue toolkit as one of the most prominent examples probably but of course there are a lot of other ones in the community that can be used from The smaller to the bigger ones. And yeah, that's also used to fulfill all these tasks from a legal perspective. Speaker 1 And if I may add to that, I think it's even beyond just legal requirements or requirements caused by the open source licenses. I think S-Bombs also helped with improving open source management in general or supported. For instance, one use case is if we as an organization had a common standard and place where to put S-Bombs and how to generate it and also how to ingest it, we could have a really good over Our site in basically how open source is used in this organization. And that could help answer questions like what is actually the most used open source component or dependency that I have in my whole supply chain of the whole organization? Or I could answer questions like which technologies are most relevant for me? Like where do I have to train my developers in? Where do I have to invest perhaps? So in general, it can help allocate resources. That could also be open source sponsoring or investment into technologies or I want that my developers contribute to their time in meeting full projects and not those only for edge Cases. So in general, S-Bombs aren't tool to help with open source management in general. ([Time 0:06:02](https://share.snipd.com/snip/c6f7c931-5d6e-47d7-939e-3909dc19f442))