Blog
How bomwerk builds software inventories you can hand to an auditor, and the trade-offs behind them. No hype, concrete numbers, limitations stated.
-
Never Crash Is a Promise. Here's How We Test It.
Every parser in bomwerk returns a result instead of throwing. That's the claim from last week's post. A claim like that only means something if you can catch the moment it breaks. What a golden corpus of real repos checks that unit tests miss, one fuzz target per parser, and why undefined behavior in an archive reader is a security question, not just a correctness one.
-
A Scanner Has Three Ways to End, Not Two
Most CLI tools exit 0 or 1: fine, or not fine. That's not enough information for a CI pipeline deciding whether to fail a build. Why bomwerk uses three exit codes, what 'ran but found something wrong' actually means, and how a scanner keeps going after it hits a file it can't read.
-
Run Your Scanner Twice. Diff the Output.
Most SBOM generators produce a different file every run: fresh timestamps, fresh UUIDs, components in whatever order the filesystem handed them over. That's fine until someone asks what changed between two releases. What breaks determinism, how we pin it down, and why a scanner should never crash.
-
Your Scanner Reads Manifests. Your Firmware Doesn't Have One.
Syft and Trivy report what they can prove from a package manifest, and a typical C/C++ embedded repo doesn't have one. The three places components go missing — vendored source, static archives, forked SDKs — three commands to measure the gap on your own repo, and what heuristic identification can't tell you.
-
Your SBOM Is One Artifact. The CRA Wants About a Dozen.
A CycloneDX file is an ingredient list, not a compliance program. What CycloneDX actually is, the five files that belong in your repo, the per-product evidence that takes longer, and which of the two CRA deadlines applies to products you already shipped.
-
Why bomwerk never shells out to git
Building an accurate software inventory means knowing which commit every vendored library is pinned to. Here's the obvious way to find that, why it's unsafe on code you didn't write, and what we do instead.
-
What Is the Cyber Resilience Act? Could You Actually Be Fined?
A plain-English guide to the EU Cyber Resilience Act (CRA): who it applies to, the two deadlines that matter, what you must report and how fast, and what non-compliance actually costs.