Videos

Surveyor IT Pro: build your CBOMs without your data ever leaving your machine

1:39, 6 chapters

Watch on YouTube All videos

You have a mandate to produce a cryptographic bill of materials (CBOM) for the software you run. Surveyor IT Pro builds one for every package version in your artifact repository on a machine you control, air-gapped. Nothing is uploaded to Spice Labs, the license is checked offline, and your artifacts and CBOMs stay on that machine. Discover the repository, then build CBOMs that list every use of cryptography with its algorithm, post-quantum status, crypto agility and call site.

https://docs.spicelabs.io

Chapters

  1. 0:00 The mandate
  2. 0:16 No way out
  3. 0:29 Discover the repository
  4. 0:41 Build the CBOMs
  5. 1:01 Read a finding
  6. 1:23 Your CBOMs, on your machine

Transcript

0:00 The mandate You have a mandate to inventory the cryptography in the software you run, and to report it as a CBOM, a cryptographic bill of materials. That software is exactly what you cannot send to anyone. Surveyor IT Pro builds your CBOMs without your data ever leaving your machine.

0:16 No way out This machine's network reaches only your artifact repository. It cannot reach Spice Labs or anything else, and Surveyor IT Pro does not need it to. It uploads nothing, and it checks its license offline.

0:29 Discover the repository Surveyor starts from the artifacts your builds already publish, so no engineering team has to change its pipeline. Point it at the repository, and it lists every package and version the repository holds.

0:41 Build the CBOMs Next, Surveyor builds the CBOMs. For each version, it downloads the artifact from your repository, maps every file inside it, finds where cryptography is called, and ranks each finding for post-quantum readiness. It writes the CBOMs here, on this machine, and nowhere else. It deletes each download once its CBOM is written.

1:01 Read a finding Each entry says what was found and what to do about it. This one is ECDSA, a signature algorithm that a large quantum computer could break. The entry names ML-DSA and SLH-DSA, the new NIST post-quantum standards, as the algorithms to move to, and it gives the exact class and line where ECDSA is called.

1:23 Your CBOMs, on your machine Building CBOMs by hand means asking every team what cryptography their software uses, and trusting the answers. Surveyor IT Pro reads the software itself, and your data never leaves your machine. You can find the details at docs.spicelabs.io.