Why keep a queryable SBOM estate instead of regenerating SBOMs when an advisory lands?
answer
- the query is the product
- answer in seconds, not rebuilds
- describes what runs, not what compiles
- index coordinates, keep the document
- an empty result is not proof
basics
~20 sA stored, queryable estate answers 'where do we run this component, and at what version' in seconds. Regenerating means rebuilding every service at its deployed commit, which is slow and describes today's source rather than what is actually running.
solid answer
~50 sAn SBOM describes one build of one artifact. An estate is every one of those documents ingested into a store, indexed by component coordinates and joined to the record of which artifact is deployed where. That join is the product: at 02:00 a bank with 900 services needs to know which of them run a given serialisation library and at which version, and it needs the answer before the next change window, not after a fleet-wide rescan. Regeneration is the wrong instrument for three reasons: repository scans describe the current branch rather than the running artifact, rebuilding at the deployed commit is often no longer possible, and the wall-clock cost across hundreds of services lands after the decision was due. The estate does that work once, at build time, and turns an incident question into a lookup.
go deeper
Be ready to say plainly what an estate is for: one stored document per built artifact, indexed so you can ask where a component runs. Know that source scanning and a deployed-artifact inventory answer different questions.
Explain the mechanics: what each record keys on, how the join from component to artifact to running service works, and why version comparison must follow the ecosystem's ordering rather than string order.
Show the operating judgment. Say out loud how strong a positive answer is versus a negative one, and how you would qualify 'we do not run it' with the estate's coverage and record age before anyone repeats it externally.
Own the framing that inventory is a capability with a running cost, not a one-off project. Be ready to argue where the money goes: build-time generation everywhere versus deeper indexing of a partial estate.
## What an estate is An SBOM (software bill of materials) is a machine-readable list of the components inside **one artifact, at one version**. On its own it is a file sitting next to a build. An *estate* is what you get when every one of those files is ingested into a store, indexed by component coordinates, and joined to a record of which artifact is actually deployed where. The estate, not the individual document, answers the question a security team is really asked: **where do we run this component, and at which version?** ## Why regeneration is the wrong instrument Picture a bank running roughly 900 services. Overnight, an advisory lands for a widely used serialisation library, and the on-call needs the exposed list before the morning change window. The instinctive move is to scan everything again. Three things go wrong: 1. **Repositories are not production.** A source scan describes the current main branch. What is running is an artifact built from some earlier commit, with dependency resolution that happened at that moment, in that build environment. The two lists differ, and the difference is exactly where incidents hide. 2. **Rebuilding at the deployed commit is often impossible.** Toolchains have moved, mirrors have drifted, credentials have rotated. Reproducing a nine-month-old build to ask it a question is a project, not a lookup. 3. **Time.** A rescan fleet across hundreds of repositories takes hours. The answer arrives after the decision had to be made. The estate pays that cost once, at build time, where the information is cheapest and most accurate, and then serves it as a query. ## What each record must carry A record ties three things together: - **The document** as it was received, stored verbatim, so you can re-derive facts later and so an auditor can see what you were told. - **The subject artifact's immutable identity** — the digest of the built image or package. Not a tag, which moves, and not a repository name, which produces many artifacts. - **A join to deployment**: artifact digest to environment, service, cluster or device fleet. A query then walks backwards: component coordinate to the documents that list it, to the artifact digests those documents describe, to the places those digests are running. ## Index coordinates, not display names Component names collide across ecosystems and change over time, so string matching produces both false negatives (a renamed package) and false positives (one word, two ecosystems). An ecosystem-qualified coordinate such as `pkg:npm/[email protected]` — the purl scheme — makes the match deterministic. Version comparison must follow the ecosystem's own ordering rules, because advisories describe **ranges**, not points; a naive lexical comparison puts `1.10.0` before `1.9.0` and quietly drops services from the answer. Keep both layers: the raw document for audit and reprocessing, and a normalised index for the query. You will change your mind about normalisation, and re-deriving from stored documents is far cheaper than re-collecting them. ## What the estate does not tell you Three limits, and confusing any of them for coverage is the classic mistake: - **It lists components, not exploitability.** That a vulnerable component is present says nothing about whether the vulnerable code is called or whether an attacker can reach it. That is a separate assessment on top of the inventory. - **It is only as complete as the documents in it.** Components a generator could not see are simply missing, and a missing component is invisible to every query you will ever run. - **It ages relative to what you deploy.** A document is a statement about a specific artifact version; it stops being useful the moment you run a different one. ## Positive and negative answers are not equally strong 'We run it in twelve services' is cheap to act on — you have twelve concrete things to look at, and each can be confirmed. 'We do not run it anywhere' is a much bigger claim: it asserts that the estate covers everything you deploy and that every document in it is complete. A junior answer that treats an empty result as proof of absence is the single most dangerous habit in this area. The honest formulation is 'no document in the estate lists it', paired with a statement of how much of the fleet the estate actually covers.
- Why key each stored document to the artifact's digest rather than to a service or repository name?A repository produces many artifacts, and a tag can be moved to point at different content later. The digest is the one identifier that names exactly the bytes that are running, so the join from document to deployment stays true even after tags are reused or a service is renamed.
- What breaks if you match components by display name instead of an ecosystem-qualified coordinate?You get both misses and noise. The same short name exists in several ecosystems, packages get renamed and republished, and vendors write the same product two different ways. A coordinate that carries the ecosystem, namespace, name and version makes the comparison deterministic, and lets version-range logic follow that ecosystem's ordering rules.
- Your query returns twelve services. Why is that a weaker answer than it looks?It is a lower bound. It reflects the documents you hold, so anything the generators failed to record, any artifact with no document, and any record describing a version you no longer run is excluded from the count. Report the number together with the coverage and age of the records behind it.
A warehouse that logs what went into every crate as it is sealed can answer 'which crates hold this part' instantly. Opening every crate to look again is both slower and a different question.
saying these in an interview costs you the question
- Says you can just rescan the repositories when an advisory drops
- Treats an empty query result as proof the component is absent
- Assumes the estate shows whether a component is exploitable
- Confuses what the source branch contains with what is deployed
- Indexes components by free-text name only