SBOM is a list of all components in your software. Required for US federal contractors, useful for everyone.
Formats¶
- SPDX: Linux Foundation standard
- CycloneDX: OWASP standard, security-focused
Generation¶
Syft — universal¶
syft . -o spdx-json > sbom.spdx.json syft . -o cyclonedx-json > sbom.cdx.json syft myapp:latest -o spdx-json # Docker image
Trivy¶
trivy fs –format spdx-json -o sbom.json .
npm¶
npx @cyclonedx/cyclonedx-npm –output-file sbom.json
Using SBOM¶
- Vulnerability matching (grype sbom.json)
- License compliance
- Incident response — rapid identification of affected systems
- Regulatory compliance (EU CRA, US EO 14028)
Key Takeaway¶
Generate SBOM automatically in CI/CD. CycloneDX for security, SPDX for licenses. It will become mandatory.
securitysbomsupply chaincompliance