When Dependency Audits Get Melodic
Steve and I were deep in the weeds yesterday, staring at SBOMs and dependency trees like they were ancient Egyptian hieroglyphics. You know the sort of thing — CycloneDX manifests, CVE cross-references, the kind of work that makes your eyes glaze over faster than a fresh build. Three hours in, we’d audited forty-seven transitive dependencies, found two moderately concerning vulnerabilities, and I’d started questioning whether the log4j in our supply chain was the Java library or just my mood.
At that point, something snapped. The brain does that when it’s been processing JSON manifests for long enough — it starts looking for patterns in the wrong places. And what pattern could possibly emerge from a software bill of materials at 2 PM on a Tuesday? Well, the answer turned out to be: a Tom Jones number. Here are the results. All credit for the original tune goes to Tom Jones and Mousse T. All blame for this belongs to someone who’s spent too long looking at package.json.
SBOM Bomb
To the tune of “Sex Bomb” by Tom Jones ft. Mousse T.
[Intro]
Oh
Oh, baby
Yeah, ooh, yeah
Huh, listen to this
[Verse 1]
Run me syft, baby, I’m a satellite
Scanning through the crates all through the night
Aim, gonna fire, trivy right
I’m gonna love the clean report
(And I love the clean report)
Now you found the CycloneDX I use
To wash away my CVE blues (Well)
So, I can’t deny or lie ’cause you’re
The only one to pass the review
(You know what you are, you are a)
[Chorus]
SBOM bomb, SBOM bomb, you’re an SBOM bomb (Uh, huh)
You can give it to me when I need to scan along (Give it to me)
SBOM bomb, SBOM bomb, you’re my SBOM bomb
And, baby, you can turn me on
(Baby, you can turn me on)
[Post-Chorus]
You know what you’re doing to me, don’t you? (Ha-ha)
I know you do
[Verse 2]
Now don’t get me wrong, ain’t gonna do you no harm (No)
This BOM’s for auditin’ and you can catalog
I’m your main target, come and help me compile (Ow)
Vuln-struck, holding you tight (Hold me tight, darlin’)
Make me explode, although you know
The route to go, to check me slow (Slow, baby)
And, yes, I must react to claims of those
Who say that you are not all that (Huh, huh, huh)
[Chorus]
SBOM bomb, SBOM bomb (Well), you’re my SBOM bomb
You can give it to me when I need to scan along
SBOM bomb, SBOM bomb (Yeah), you’re my SBOM bomb (Huh)
And, baby, you can turn me on (Turn me on, darlin’)
SBOM bomb, SBOM bomb (Ah-ah), you’re my SBOM bomb (SBOM bomb)
You can give it to me when I need to scan along
SBOM bomb, SBOM bomb, you’re my SBOM bomb
And, baby, you can turn me on (Ha-ha-ha)
[Interlude]
Ouch
SBOM bomb
Oh, baby
[Final Chorus]
SBOM bomb, SBOM bomb, you’re my SBOM bomb
And you can give it to me when I need to be scanned on (No, no)
SBOM bomb, SBOM bomb (Well), you’re my SBOM bomb
And, baby, you can turn me on (Turn me on)
[Outro]
And, baby, you can turn me on (Turn me on)
Baby, you can turn me on (fade out)
Best performed while standing at the whiteboard, holding a printout of your dependency graph, with maximum commitment. All backing vocals, ad-libs, and interjections from the original are preserved. The audit trail, however, is yours alone.
