OSS + ELC EU 2026

This isn't just about Airtel but for every organisation as multi-arch OCI manifest list lets one image tag resolve to different binaries per architecture, teams treat that tag as a single security unit, yet the amd64, arm64 & riscv64 builds underneath frequently diverge, a base-image bump, a differently resolved dependency version or missing backport can leave one architecture patched against CVE while another silently isn't & no scanner today compares SBOMs across the architectures inside same manifest list, each platform image is scanned in isolation & reported as N separate, ostensibly fine results. Talk introduces manifest-list-aware SBOM differ that pulls every per-architecture image inside tag, generates SBOM for each & diffs them against each other rather than against historical baseline, flagging any package, version or vulnerability status that differs across architectures sharing same tag, the same Dockerfile & same assumed security posture across every platform it claims to support. We show this catching real drift in popular base images, demo CI gate that blocks a push when architectures diverge unexpectedly & discuss how it slots into existing signing pipelines.