ActiveState’s SBOM-first approach: Revolutionizing open-source dependency management

Open-source has unleashed a wave of innovation, making development faster, more collaborative, and more cost-effective. However, it has also introduced big challenges, hidden dependencies, security vulnerabilities, and compliance risks. Managing these complexities has always been reactive, leaving organizations exposed to threats.

ActiveState is changing the game with its SBOM-first approach, a proactive methodology that brings transparency, security, and efficiency to open-source dependency management. By starting with a Software Bill of Materials (SBOM) rather than generating it as an afterthought, ActiveState enables organizations to have full visibility into their software supply chain. This pioneering approach means security, simplifies compliance, and lets developers use open-source components without the risks of “dependency hell”.

In a recent webinar, Scott Robertson, CTO at ActiveState, and Pete Garcin, Senior Director of Product, sat down with Twain, editor at Software Plaza, to discuss how this SBOM-first approach is redefining software development and supply chain security. Let’s dive into the webinar and see how this is shaping the future of open-source dependency management.

The open-source revolution

Open-source is the backbone of modern software development, with over 90% of codebases comprising open-source components. This has brought massive benefits, speeding up development cycles and giving access to a vast ecosystem of pre-built components. But it’s not without its problems.

The ease of open-source has led to a phenomenon we call “dependency hell.” Developers often unknowingly create many indirect dependencies when installing a single package. This complexity has created visibility issues, with organisations struggling to track and manage the open-source components across different teams and projects.

What is an SBOM?

A Software Bill of Materials (SBOM) is the secret ingredient in your software recipe. It’s a complete list of the ingredients that make up your software application and all the juicy details about those ingredients. Think of it as the nutritional label for your code – it tells you exactly what’s inside.

An SBOM includes:

• A complete list of software supply chain dependencies, including all those sneaky transitive dependencies
• The lowdown on each component – who made it, what license it’s under, which version you’re using
• A machine-readable format that lets you automate SBOM consumption and integrate it with your existing processes

The SBOM-first revolution: Flip the script

ActiveState’s approach turns the traditional development process on its head. Instead of generating an SBOM at the end of the development cycle, ActiveState starts with the SBOM. This flips the script and offers several big advantages:

1. Immutable open-source component catalog: ActiveState has an up-to-date catalog of open-source components, capturing nightly releases from all the ecosystems. This ensures reproducibility and provenance for all components.
2. Cross-ecosystem dependency resolution: ActiveState’s “solver” can understand and manage dependencies across different ecosystems, such as Python, Go, and Rust. This is critical in today’s polyglot development environments.
3. Proactive vulnerability management: By having an up-to-date catalog and SBOM for each project, ActiveState can notify customers of vulnerabilities, automatically rebuild dependencies, and provide ready-to-use updates when vulnerabilities are found.

SBOM in action

SBOMs are a powerful risk management tool for organizations to:

• Identify and mitigate attack vectors
• Meet regulatory requirements
• Ensure compatibility with old software packages and OSS updates
• Protect customers in case of software supply chain attack
• Manage license compliance

And SBOMs are now a requirement for software vendors to sell to US federal governments and agencies, as per President Biden’s Executive Order on enhancing the nation’s cybersecurity.

ActiveState’s SBOM platform: 5 features that matter

ActiveState’s platform brings SBOM-first to life with:

1. Dependency discovery and analysis: The platform can import SBOMs from various sources like Kubernetes clusters and GitHub repositories. It then analyzes and categorizes dependencies by language and vulnerability profile, giving you a view of your software supply chain.
2. Intelligent remediation: When vulnerabilities are found, the platform suggests the optimal version upgrades to reduce risk and minimize breaking changes. It provides information on potential impact so you can make informed decisions.
3. Automated builds from source: ActiveState’s platform can rebuild components from source code, giving you provenance and security. No more complex build processes for you to manage so that you can focus on innovation.
4. Integration support: The platform generates instructions and pull requests to integrate updates into your deployment systems so you can update across your infrastructure.
5. Full audit: All changes are captured with exact catalog revision IDs so you can recreate any environment anytime for debugging and compliance.

Join the SBOM-first future

In a world where software supply chain attacks are on the rise and dependency management is becoming increasingly complicated, ActiveState’s SBOM-first approach is a lifeline. By prioritizing visibility, security, and developer productivity, this approach will change how you manage open-source dependencies.

One thing is clear: SBOM-first isn’t just a trend; it’s a fundamental shift in how we build and secure software. If you want to stay ahead of the curve in open-source dependency management, embracing this approach may be the key to a more secure and efficient software development future.

Don’t just take our word for it; watch the webinar featuring Scott Robertson and Pete Garcin as they explore the future of open-source dependency management. Check out the webinar now and take the first step toward a more secure and efficient software supply chain!

Ready to change your open-source dependency management? Try ActiveState’s SBOM-first and start your journey to a more secure, efficient, and compliant software development process.