you
Okay, I start again. No, I'm not only 15 minutes. So the S-bomb thing piece is an obligation
Right and more than that, you know, it's not actually that you've got one artifact in your product
You've got actually multiples and multiple artifacts, right?
Some have to our containers. They are on an OCI registry some are Java files
They are landing in in an Maven repo and so on and so
You got all these things and then additionally you got salsa. Obviously, it's about getting security from the producer to the consumer
and we were actually also
Thinking about this problem and started to say hey in order to ship a product
We have all these different artifacts. We and S-bombs are an additional artifact, right?
So how about can we create can we use the S-bomb initiative to create an S-bomb around all these artifacts?
Can we use it to describe actually more transport metadata about our product and can we more or less make it an
give it an
operational purpose because then the obligation is not a site initiative anymore
But it's part of your intrinsic product and you can't do without and that's how you get hundred percent quality into them, right?
And obviously you got to do this technology agnostic
So with that we started a little bit even earlier before S-bomb became a big thing something that we now open sourced as well as
open component model and
I'll talk about this
Again in these slides this way
So we actually wrap the open component model around all the artifacts. How does it look like?
Essentially, it's a piece of Yammel file forget about the syntax. It doesn't actually matter
It's a semantics that's important and it's a graph of pointing to to other component models and to the artifacts to binary artifacts as well
And also including
The S-bombs as well
So what can we do with that and I totally relate to the panel discussion because naming is important and some of the things are
intrinsic
Contents and some of the things are extrinsic
Extrinsic content so what we can do is we can build a compliance data lake and put a compliance dashboard
Now we have an identifier and connect all these scans and everything like that is bn code
That's what we are actually doing. We are also having some stuff which we
Which we open source around this in the same area the next thing what we can do obviously these component models are
hierarchically built so we can connect internal teams and not to
Reinvent the wheel anymore not to do the compliance checking over and over ten times again
We just say you've got it done sign it attest it
We can use it and we can also do it in with third parties
So if we can get that kind of
Attestation from a third-party vendor
Using in standard like S-bom then yes, we we don't need to do it again
We trust that a station to some degree right and now one of the inbuilt tooling for why we built ocm was
We were able to do
Calculate the transit of all of the artifacts that we have linked and we can actually transport the stuff from one
repository or multiple repository on the public cloud
Take take that as an example into the private cloud no more missed artifact right because that's the source of truth
right and
And with the metadata we can actually give the consumer something in hand the deja code and so on is a good example
They can actually trust us, but then can verify this is in the context of a commercial product obviously right and
But the other thing which is much more important here is you know all about the CI CD
How do you do CI CD in order to a private cloud where your deaf people do not have access to right?
So you know what we did is we basically use the same tooling because if you can do push you can also do pull and
Now all of a sudden you can actually decouple CI from CD from the deployment part right and
Now the question is because
Got it because now you we can deliver the continuous D stands for delivery, but how do we do continuous deployment?
So think about this you got to take your deaf ops thinking
package it and transport it into a private or regulated environment right and be able to reproduce it and
So therefore obviously you can ship all your infrastructure as code stuff in there
The best thing is you do it in a declarative way
And you got to do two things in order to make continuous deployment happen first of all the localization
Because now you're not loading from public dot cloud or Docker hub or whatnot
It's the private cloud and Docker private hub right so all of a sudden you got to say my my my container comes from that OCI
repository so that's about localization
right and
Second is you got to in inject the configuration my secret you know all that stuff has to happen
These are two things you have to do to do in order to do continuous deployment and the way we did this is
Or no, I got to talk about the operational source of it now all of a sudden this S-bomb piece
What we you know we by the way call it software bill of delivery
The Ocm thing becomes our operational source of truth because that thing knows where every piece of component sticks in and so we obviously
use git for local
For for configuration and use tools like flux to do the localization with
Modern github's mechanisms and then instead of doing
Infrastructure as code we try to do infrastructure or configuration as data. I've heard some talks to this this
Yesterday about that as well and with that we actually get to continuous deployment in arbitrary clouds
and
Yeah, I would say
Again not my slides
Colleagues slides and what we wanted to convey with this is S bombs can be actually your ring to control them all right you got just
Yeah, you just got to make them
Operationally valuable right now you're on an obligatory path
You just have to do it nobody likes to do it, but you've got to do it
And if you make this an operational source of truth, that's what we think it is and for us
Ocm yeah, we're part of the puzzle. I think we're the syntax does not matter
We can actually inject our stuff into the S bond specification cyclone DX or spdx, but you know we it's a parallel thing
I'm gonna do it very quickly. There's some unique
Characteristics which we have
I'm almost out of time so I'm gonna wrap it up where technology as
Agnostic we describe a software bill of delivery. We're not interested what's inside because that S bombs take care of we're only
Interested about the product description and last not least we do not replace the stuff. We just wrap things have a look
Ocm dot software and yeah, that's it
Thank you
One question yeah, okay made it in 15 minutes and I'm