# Using Conan for C SBOMs

> How to use the Conan package manager to generate SBOMs for C and C++ projects, addressing the lack of native package management in these languages.

- **Author:** Chris Swan
- **Published:** 2025-09-04
- **Categories:** Guide
- **Tags:** Sbom, Conan, Cpp
- **Updated:** 2026-04-12

Last November I wrote about
[The C conundrum](https://sbomify.com/2024/11/18/c-conundrum/) as there's so
much C code that needs SBOMs, but there was no straightforward way to
generate them.

[Conan](https://conan.io/) got a mention, but at the time wasn't working as
hoped.

Thankfully things have improved since then, which means that Conan provides
a viable route to generating SBOMs for C (and C++) projects.

The most crucial change is that SBOM generation tools like Aqua's
[Trivy](https://trivy.dev/) can now generate reasonable output from Conan lock
files. (Note: we [no longer consider Trivy safe](https://sbomify.com/2026/03/26/trivy-compromise-hardening-sbomify-action/) following its March 2026 compromise and have removed it from sbomify-action.) That in turn means that sbomify can use a `conan.lock` file in the same
way it would use a lock file for any other package manager.

The Conan [documentation](https://docs.conan.io/2/) and
[tutorial](https://academy.jfrog.com/conan-2-essentials) have improved
dramatically, which makes it much easier to get started.

It's relatively straightforward to 'bolt on' a `conanfile.py` to a project and
use it to describe dependencies. A `conan.lock` can then be generated and
used as the basis of an SBOM. The only problem is that any changes to the
project dependencies need to be (manually) updated in the Conan file.

A more integrated approach means going all in on Conan, and using it to
generate configuration and build descriptions like `CMakeLists.txt`.
Conan is very capable and flexible, and an easy win for a green field project.
But the 6.5 billion lines of open source C out there are testament to a huge
brown field problem. There's been huge investment in the existing config and
build systems for those projects, encapsulated in CMake, GNU Autotools, and
many other systems. Refactoring those projects into Conan will require deep
understanding of the existing tool chain, and how Conan generates builds.
We might wish for an AI magic wand to make the transition easy, but it seems
to be a task that's beyond the present generation of coding assistants.

As regulatory pressure from the EU Cyber Resilience Act
([CRA](https://en.wikipedia.org/wiki/Cyber_Resilience_Act)) and other mandates
mounts there's going to be increasing interest in getting SBOMs for C stuff.
Conan can be used as a 'bolt on' workaround, and with increased adoption
and familiarity may become the de facto way of doing things. At least for
everything that lies outside of other package ecosystems like Yocto and
Zephyr.

This is a guest post from [Chris Swan](https://cpswan.net), an advisor at
sbomify and an Engineer at [Atsign](https://atsign.com) who are an early
adopter of sbomify.

---

From sbomify: https://sbomify.com/2025/09/04/conan/