James Fuller

— On the schedule —

Managing millions of sboms with trustify

SBOMs are piling up faster than security teams can process them: every build, every container, every release, every backport has to be cross-referenced against a constantly shifting stream of CVEs, OSV records, and vendor VEX statements just to know what actually matters. This talk covers how Rust/postgres based Trustify (https://github.com/guacsec/trustify) manages scale while supporting vulnerability correlation: answering the central question "is this component affected by this CVE" (or vice versa) across PURL identity, CPE identity, and product matching. In Trustify, vulnerability correlation is an "observation" derived from evidence: confidence-scored, explainable assertions like "CVE-X affects component-Y," backed by supporting and conflicting evidence rather than a single boolean. At SBOM volumes in the millions, you run straight into the three V's of data, volume, velocity, and veracity: more documents arriving faster from more producers, each with its own idea of what "affected" means and its own quality bar. Data erodes at scale, so I'll talk about why Trustify treats every ingested document as evidence to be kept as-is, warts and all, with full provenance: who asserted it, when, and its signature status. The talk closes with how Trustify is meant to be a deterministic "anchor" in the security storm, for use by people and agents alike: a fixed temporal point of "here's what was actually asserted, by whom, with what confidence" that can be reasoned against, rather than another probabilistic layer stacked on top of probabilistic outputs.