# The sbomify Blog

> Articles, guides, and product updates on SBOMs, software supply chain security, and compliance from the sbomify team.

## Pages

- [This Week in SBOMs: OpenSSH's musl Hole, APT Swaps Packages, and the CRA Reporting Platform Hits v1.3](https://sbomify.com/2026/11/06/this-week-in-sboms-2026-11-06/) (2026-11-06): SBOM news for 31 October to 6 November 2026: the OpenSSH 10.6p2 password bypass on musl systems (CVE-2026-123158), the APT man-in-the-middle flaw CVE-2026-109518, zlib 1.4 and libexpat 2.10.0, ENISA's SRP v1.3 and secure-update advisory, MAS's cryptographic inventory proposal, and a quiet week for SPDX, CycloneDX and PURL releases.
- [This Week in SBOMs: PHP2Shell Goes Live, Brotli Hides Behind Version Numbers, and Alpine's GitLab Scare](https://sbomify.com/2026/10/30/this-week-in-sboms-2026-10-30/) (2026-10-30): SBOM news for 24 to 30 October 2026: PHP2Shell added to CISA KEV and exploited in firewalls, the Brotli CVE-2026-111497 KEV entry and PHP's rebuilt Windows packages, the attempted GitLab exploit at Alpine Linux, a quiet week for the CRA and NIS2, NIST IR 8547 final, CISA 2030, and steady work on SPDX, CycloneDX and PURL.
- [This Week in SBOMs: PHP2Shell, a Wave of Poisoned Releases, ENISA's SBOM Advisory and Germany's CRA Law](https://sbomify.com/2026/10/23/this-week-in-sboms-2026-10-23/) (2026-10-23): A month of SBOM news, 22 September to 22 October 2026: the PHP2Shell RCEs, LiteLLM and other poisoned releases, compromised eMudhra CA keys, the ENISA Technical Advisory for SBOMs, national CRA implementation laws in Germany, Italy and France, ENISA SRP updates, NIS2 reporting reshaped by the Digital Omnibus, PURL and VERS approved by Ecma TC54, CycloneDX 2.0 proposals.
- [Announcing sbomify-action v26.9.0: The One That Runs on Every CI](https://sbomify.com/2026/09/24/announcing-sbomify-action-v26-9-0-the-one-that-runs-on-every-ci/) (2026-09-24): sbomify-action v26.9.0 gives TeamCity, Jenkins, CircleCI and Travis CI first-class support through a new CI platform subsystem, fixes the GitLab invocation we had published in every non-GitHub example, adds DOCUMENT_FILE for publishing PDFs and reports from a pipeline, and makes SPDX 3 documents survive a round trip intact.
- [Announcing sbomify v26.9.0: The One That Speaks SPDX 3](https://sbomify.com/2026/09/24/announcing-sbomify-v26-9-0-the-one-that-speaks-spdx-3/) (2026-09-24): sbomify v26.9.0 makes SPDX 3 a first-class format end to end, ships a v2 API that calls things what the product calls them, adds a Helm chart for self-hosting on Kubernetes, puts certification badges and CSAF 2.0 discovery on the Trust Center, and rebuilds vulnerability browsing around a real findings table.
- [The CRA Single Reporting Platform Opens Tomorrow: What ENISA Actually Requires](https://sbomify.com/2026/09/10/cra-single-reporting-platform-enisa-srp/) (2026-09-10): ENISA's CRA Single Reporting Platform goes live on 11 September 2026 with Article 14 reporting obligations. Registration, Assigned Representative roles, the 24/72-hour clocks, CSIRT selection, and the fields you will be typing.
- [Announcing sbomify-action v26.8.0: The One That Went on a Diet](https://sbomify.com/2026/08/25/announcing-sbomify-action-v26-8-0-the-one-that-went-on-a-diet/) (2026-08-25): sbomify-action v26.8.0 cuts the container image from 515MB to 106MB by fetching verified, attested tool bundles on demand, ends silent SBOM quality downgrades, adds git submodule support, and introduces Clearly Cached, a caching proxy that makes ClearlyDefined license data actually usable from CI.
- [Announcing sbomify v26.8.0: The One With Security Advisories](https://sbomify.com/2026/08/25/announcing-sbomify-v26-8-0-the-one-with-security-advisories/) (2026-08-25): sbomify v26.8.0 adds full security advisory publishing with per-product gating, a rebuilt Trust Center, patch SLA targets and CRA KPIs, formal risk acceptance, malicious package detection, CSV evidence exports, and a new brand.
- [BSI TR-03183 Is Now Four Documents, and the CRA Clock Runs Out in Three Weeks](https://sbomify.com/2026/08/20/bsi-tr-03183-four-parts-cra-update/) (2026-08-20): BSI published TR-03183-1 in version 1.0.0 on 31 July 2026, completing a four-part CRA guideline family. Here is what changed across TR-03183, the Commission's July 2026 guidance, and the ENISA Single Reporting Platform before 11 September.
- [Announcing sbomify v26.7.1: The One That Says "Not Affected"](https://sbomify.com/2026/07/30/announcing-sbomify-v26-7-1-the-one-that-says-not-affected/) (2026-07-30): sbomify v26.7.1 ships end-to-end VEX support across CycloneDX, OpenVEX, and CSAF, with in-product triage, Dependency-Track sync, and scheduled drift detection. CBOM ingestion now covers every lineage, the Trust Center exposes VEX and CBOM per release, and vulnerability counts finally reflect your current posture.
- [ENISA's New Healthcare Procurement Guidelines Ask for SBOMs Without Saying the Word](https://sbomify.com/2026/07/23/enisa-healthcare-procurement-guidelines/) (2026-07-23): ENISA's July 2026 procurement guidelines for hospitals and healthcare providers require supply chain transparency, component listings, and vulnerability management. Here is how SBOMs satisfy them.
- [Announcing sbomify v26.7.0: The One That Gets Quantum-Ready](https://sbomify.com/2026/07/07/announcing-sbomify-v26-7-0-the-one-that-gets-quantum-ready/) (2026-07-07): sbomify v26.7.0 adds Cryptography BOM (CBOM) support with NIST-grounded post-quantum readiness assessment, per-token API rate limiting with audit logging, a rebuilt authorization layer, and a broad security hardening pass.
- [Announcing sbomify v26.3.0: The One That Ditches the Token](https://sbomify.com/2026/06/12/announcing-sbomify-v26-3-0-the-one-that-ditches-the-token/) (2026-06-12): sbomify v26.3.0 adds GitHub Actions OIDC trusted publishing so you can push SBOMs with no long-lived API token, expires personal access tokens by default, removes the Project layer, and ships a broad security and access-control hardening pass.
- [SPDX 3.0 in Yocto: What Changed and Why It Matters](https://sbomify.com/2026/05/19/yocto-spdx-3-0-overview/) (2026-05-19): Part 3 of the Yocto SBOM series. SPDX 3.0 support arrived in Styhead (Yocto 5.1) with single-document JSON-LD output, first-class Build elements, native VEX support, and richer build provenance features.
- [Announcing sbomify v26.2.0: The One That Signs the DoC](https://sbomify.com/2026/05/13/announcing-sbomify-v26-2-0-the-one-that-signs-the-doc/) (2026-05-13): sbomify v26.2.0 completes the EU CRA workflow with a signed Declaration of Conformity, adds Component Lifecycle Events, SBOM signatures and provenance, and full CycloneDX 1.7 / SPDX 3.0.1 support.
- [A Deep Dive into Yocto's SPDX 2.2 Pipeline](https://sbomify.com/2026/05/12/yocto-spdx-2-2-pipeline/) (2026-05-12): Part 2 of the Yocto SBOM series. How the create-spdx-2.2.bbclass produces SPDX documents during a Yocto build, the three core BitBake tasks involved, and the document-linking model that ties everything together.
- [How Yocto Generates SBOMs Behind the Scenes: A Deep Dive into SPDX 2.2 and SPDX 3.0](https://sbomify.com/2026/05/05/yocto-sbom-deep-dive-introduction/) (2026-05-05): Yocto generates SBOMs during the build itself, not after. Part 1 of a 6-part series on how the Yocto Project builds SPDX 2.2 and SPDX 3.0 SBOMs from BitBake metadata, with first-class VEX support.
- [Announcing sbomify v26.1.0: The One Where We Switch to CalVer](https://sbomify.com/2026/04/02/announcing-sbomify-v26-1-0-the-one-where-we-switch-to-calver/) (2026-04-02): sbomify v26.1.0 introduces the CRA Compliance Wizard, switches to CalVer versioning, adds Trust Center subdomain routing, and brings full TEA v0.4.0 compatibility.
- [Trivy Compromise: How We Are Hardening sbomify-action](https://sbomify.com/2026/03/26/trivy-compromise-hardening-sbomify-action/) (2026-03-26): Aqua Security's Trivy was compromised twice in two weeks. Here is how we audited and hardened sbomify-action in response, and why we are moving to short-lived OIDC tokens.
- [SBOM Adoption on PyPI Is at 1.58%. We Can Do Better.](https://sbomify.com/2026/03/12/pypi-sbom-analysis/) (2026-03-12): We scanned 15,021 of the most popular Python packages for PEP 770 SBOMs. Only 1.58% include one, and every single SBOM is CycloneDX. Here are the full results.
- [PEP 770: SBOMs Are Now a First-Class Citizen in Python Packages](https://sbomify.com/2026/03/05/pep-770-sboms-in-python-packages/) (2026-03-05): Python's PEP 770 standardizes shipping SBOMs inside packages via .dist-info/sboms/. Here's what it means and how we adopted it in two projects with minimal effort.
- [Announcing sbomify-action v0.14: The One With Yocto](https://sbomify.com/2026/03/02/announcing-sbomify-action-v0-14-the-one-with-yocto/) (2026-03-02): sbomify-action v0.14 adds a dedicated Yocto/OpenEmbedded batch processing command, full SPDX 3.0.1 pipeline support, pipdeptree integration for Python transitive dependencies, caching for faster CI runs, and renames from github-action to sbomify-action.
- [Why We're Bullish on TEA, And Why You Should Be Too](https://sbomify.com/2026/03/01/why-were-bullish-on-tea/) (2026-03-01): The Transparency Exchange API (TEA) is the missing standard for automated SBOM discovery and exchange. Here's what it is, why it matters, and why sbomify is all in.
- [Announcing sbomify v0.27: The One with TEA](https://sbomify.com/2026/02/24/announcing-sbomify-v0-27-the-one-with-tea/) (2026-02-24): sbomify v0.27 adds full Transparency Exchange API (TEA) support, SPDX 3.0 compatibility, scoped access tokens, and improved account management.
- [Announcing sbomify v0.26: The One Where Bootstrap Moved Out](https://sbomify.com/2026/02/16/announcing-sbomify-v0-26-the-one-where-bootstrap-moved-out/) (2026-02-16): sbomify v0.26 delivers a faster, more accessible UI, real-time dashboard updates, BSI TR-03183-2 compliance, and GDPR self-service account deletion.
- [The Role of SBOMs in Cybersecurity: From Visibility to Vulnerability Response](https://sbomify.com/2026/02/08/sbom-cybersecurity-role/) (2026-02-08): Learn how SBOMs strengthen cybersecurity through component visibility, vulnerability management, incident response, and compliance with EO 14028, EU CRA, and more.
- [What Is CVSS? Understanding Vulnerability Severity Scoring](https://sbomify.com/2026/02/05/what-is-cvss-vulnerability-scoring/) (2026-02-05): Learn what CVSS is, how vulnerability severity scores are calculated, the differences between CVSS v3.1 and v4.0, and how to use CVSS with KEV and SBOMs for prioritization.
- [Announcing sbomify-action v0.13: The One Where We Go to FOSDEM](https://sbomify.com/2026/02/04/announcing-sbomify-action-v0-13-the-one-where-we-go-to-fosdem/) (2026-02-04): sbomify-action v0.13 brings hash enrichment from lockfiles, an interactive configuration wizard, Conan Center integration for C/C++, and improved NTIA compliance with supplier fields and PURL generation from VCS URLs.
- [SBOM Scanning: How to Detect Vulnerabilities in Your Software Components](https://sbomify.com/2026/02/01/sbom-scanning-vulnerability-detection/) (2026-02-01): Learn how SBOM scanning works, which tools to use, how to set up continuous vulnerability monitoring, and how to act on scan results effectively.
- [What Is a Dependency in Software? A Beginner's Guide](https://sbomify.com/2026/01/29/what-is-a-dependency-in-software/) (2026-01-29): Learn what software dependencies are, the difference between direct and transitive dependencies, how dependency trees work, and how SBOMs document them.
- [SBOM Generation Tools Compared: Syft, Trivy, cdxgen, and More](https://sbomify.com/2026/01/26/sbom-generation-tools-comparison/) (2026-01-26): Compare the leading SBOM generation tools – Syft, Trivy, cdxgen, Microsoft SBOM Tool, and CycloneDX CLI – covering format support, ecosystems, and CI/CD integration.
- [Announcing sbomify v0.25: The One with Attestations](https://sbomify.com/2026/01/23/announcing-sbomify-v0-25-the-one-with-attestations/) (2026-01-23): sbomify v0.25 introduces GitHub Attestation verification via Sigstore/cosign, SPDX 2.3 export, product lifecycle tracking, and compliance badges.
- [The MIT License: A Complete Guide for Developers](https://sbomify.com/2026/01/22/mit-license-guide/) (2026-01-22): Understand the MIT License – what it permits, what it requires, how it compares to BSD and Apache 2.0, and how SBOMs help track MIT license compliance.
- [Announcing sbomify-action v0.11: The One Where They Go to PyPI](https://sbomify.com/2026/01/20/announcing-sbomify-action-v0-11-the-one-where-they-go-to-pypi/) (2026-01-20): sbomify-action v0.11 transforms from a CI-only tool into a fully-fledged CLI available on PyPI. Major additions include audit trails for compliance, SPDX format support, a pre-computed license database covering 28 Linux distro versions, and native Rust SBOM generation.
- [SBOM Management: How to Organize, Track, and Act on Your SBOMs](https://sbomify.com/2026/01/18/sbom-management-best-practices/) (2026-01-18): Learn how to manage SBOMs across the full lifecycle – from generation and storage to vulnerability monitoring, versioning, and distribution to consumers.
- [SBOM Formats Compared: CycloneDX vs SPDX](https://sbomify.com/2026/01/15/sbom-formats-cyclonedx-vs-spdx/) (2026-01-15): A practical comparison of CycloneDX and SPDX SBOM formats covering history, governance, field differences, tooling, compliance preferences, and when to use which.
- [Announcing sbomify v0.24: The One with All the Plugins](https://sbomify.com/2026/01/14/announcing-sbomify-v0-24-the-one-with-all-the-plugins/) (2026-01-14): sbomify v0.24 introduces a powerful plugin-based assessment framework supporting security, license, compliance, and attestation plugins. Ships with NTIA, CISA, CRA, and FDA compliance plugins out of the box.
- [Software Composition Analysis (SCA): What It Is and How SBOMs Fit In](https://sbomify.com/2026/01/11/software-composition-analysis-sca/) (2026-01-11): Learn what software composition analysis is, how SCA tools work, how SCA compares to SAST and DAST, and how SBOMs complement SCA for full supply chain visibility.
- [FDA Medical Device SBOM Requirements: What the New Cybersecurity Guidance Means for Manufacturers](https://sbomify.com/2026/01/09/fda-medical-device-sbom-requirements/) (2026-01-09): Breakdown of the FDA's June 2025 guidance on medical device cybersecurity, explaining SBOM requirements, premarket submission expectations, and compliance strategies.
- [Apache License 2.0: What It Is, How It Works, and What It Means for Your Software](https://sbomify.com/2026/01/07/apache-license-2-guide/) (2026-01-07): Understand the Apache License 2.0, its patent grant, attribution requirements, NOTICE file, compatibility with GPL, and how SBOMs track compliance.
- [CRA Explained: What the Cyber Resilience Act Means for Device Manufacturers](https://sbomify.com/2026/01/06/cra-explained-cyber-resilience-act-for-device-manufacturers/) (2026-01-06): Podcast episode with EU CRA expert Sarah Fluchs explaining SBOM requirements, the 5-year support mandate, and vulnerability management for device manufacturers.
- [Container Security: Best Practices for Securing Docker and Kubernetes](https://sbomify.com/2026/01/03/container-security-best-practices/) (2026-01-03): A comprehensive guide to container security covering image scanning, runtime protection, network policies, and how SBOMs provide component visibility.
- [What Is a KEV? Understanding CISA's Known Exploited Vulnerabilities Catalog](https://sbomify.com/2025/12/30/what-is-kev-cisa-known-exploited-vulnerabilities/) (2025-12-30): What is a KEV? CISA's Known Exploited Vulnerabilities catalog lists CVEs under active attack. Learn how KEV differs from CVE and CVSS, and how SBOMs automate KEV monitoring.
- [Software Supply Chain Management: Risks, Best Practices, and SBOM Integration](https://sbomify.com/2025/12/26/software-supply-chain-management/) (2025-12-26): Learn what software supply chain management is, how attacks like Log4Shell and XZ Utils exploit it, and how SBOMs provide visibility and risk reduction.
- [The GPL License: A Comprehensive Guide to the GNU General Public License](https://sbomify.com/2025/12/22/gpl-license-guide/) (2025-12-22): Understand the GPL license, including GPL v2 vs v3, copyleft obligations, LGPL, AGPL, commercial use, and how SBOMs track GPL compliance.
- [Major Updates: sbomify v0.21 and Action Module v0.8 & v0.9](https://sbomify.com/2025/12/19/major-updates-sbomify-v0-21-and-action-modules/) (2025-12-19): Triple release: sbomify v0.21 with vulnerability trends dashboard, plus GitHub Action v0.8 and v0.9 featuring modular generation plugins and 8 enrichment data sources.
- [CVE Vulnerabilities Explained: What They Are and Why They Matter](https://sbomify.com/2025/12/18/cve-vulnerability-explained/) (2025-12-18): Learn what CVE vulnerabilities are, how the CVE system works, the role of MITRE and NVD, and how SBOMs enable rapid vulnerability response.
- [Software Development Life Cycle (SDLC): A Complete Guide](https://sbomify.com/2025/12/15/software-development-life-cycle-sdlc-sbom-integration/) (2025-12-15): Learn what the Software Development Life Cycle (SDLC) is, its phases and models, and how SBOMs integrate into each stage for security and compliance.
- [Announcing sbomify v0.20: Custom Domains & Streamlined Onboarding](https://sbomify.com/2025/12/12/announcing-sbomify-0-20/) (2025-12-12): sbomify v0.20 release featuring custom domain support for Trust Centers, redesigned onboarding wizard, team invitation improvements, and security hardening.
- [Announcing GitHub Action 0.7.0 and sbomify 0.19](https://sbomify.com/2025/12/05/announcing-github-action-0-7-0-and-sbomify-0-19/) (2025-12-05): Major releases: GitHub Action 0.7.0 with ecosyste.ms enrichment and SPDX support, plus sbomify 0.19 with full Django+HTMX migration, custom domains, and CycloneDX 1.7.
- [Using Conan for C SBOMs](https://sbomify.com/2025/09/04/conan/) (2025-09-04): How to use the Conan package manager to generate SBOMs for C and C++ projects, addressing the lack of native package management in these languages.
- [CISA's Minimum Elements now in Draft](https://sbomify.com/2025/08/23/cisa-minimum-elements/) (2025-08-23): Analysis of CISA's 2025 draft SBOM Minimum Elements update, adding required hash, license, and tool provenance fields to succeed the 2021 NTIA guidance.
- [Big Update to sbomify](https://sbomify.com/2025/07/04/big-update-to-sbomify/) (2025-07-04): sbomify v0.15 introduces document support alongside SBOMs, improved public pages, and product-level SBOM aggregation – evolving into a complete compliance hub.
- [Unpacking Raspberry Pi's Built‑In SBOM Magic](https://sbomify.com/2025/04/17/unpacking-raspberry-pi-s-built-in-sbom-magic/) (2025-04-17): How Raspberry Pi's rpi-image-gen tool generates SPDX SBOMs out of the box, achieving a 7.8/10 quality score with sbomqs for embedded image builds.
- [Mastering SBOM Generation with Yocto](https://sbomify.com/2025/02/21/mastering-sbom-generation-with-yocto/) (2025-02-21): Deep dive into Yocto's built-in SPDX 2.2 SBOM generation, analyzing output quality with sbomqs and integrating with sbomify for SBOM lifecycle management.
- [Chris Swan Joins sbomify Advisory Board](https://sbomify.com/2025/02/21/chris-swan-joins-sbomify/) (2025-02-21): Chris Swan, Engineer at Atsign and former CTO at UBS, joins sbomify's advisory board bringing DevOps, open source, and cybersecurity expertise.
- [sbomify Goes Open Source: A New Chapter in SBOM Management](https://sbomify.com/2025/01/31/announcing-sbomify-open-sourced/) (2025-01-31): sbomify is now open source under Apache 2.0 plus Common Clause. Learn about our hierarchical SBOM approach, CycloneDX support, and Project Koala integration plans.
- [How SBOMs Can Help You Achieve PCI DSS 4.0 Compliance](https://sbomify.com/2025/01/07/how-sboms-can-help-you-achieve-pci-dss-4-compliance/) (2025-01-07): Discover how Software Bill of Materials (SBOMs) help online gambling and e-commerce businesses achieve PCI DSS 4.0 compliance through better vulnerability management and audit trails.
- [The C conundrum - generating SBOMs when there's no lockfile](https://sbomify.com/2024/11/18/c-conundrum/) (2024-11-18): Exploring the challenge of generating SBOMs for C/C++ projects without native package managers, reviewing cmake-sbom, Conan, cve-bin-tool, and CISA working group efforts.
- [sbomify GitHub Action v0.3.0: Now Faster and Compatible with GitLab!](https://sbomify.com/2024/11/12/gitlab-support/) (2024-11-12): sbomify GitHub Action v0.3.0 release adds GitLab CI/CD support, 50% faster build times, and bug fixes for Docker image SBOM generation.
- [GitHub Action module with Attestation](https://sbomify.com/2024/10/31/github-action-update-and-attestation/) (2024-10-31): New features in sbomify's GitHub Action including Dart lockfile support, Docker image SBOMs, NTIA enrichment, and SLSA build provenance attestation.
- [Big update to our GitHub Action](https://sbomify.com/2024/10/04/github-action-update/) (2024-10-04): Major overhaul of sbomify GitHub Action transforming it from a simple upload tool to a complete SBOM Swiss Army knife with generation, augmentation, and enrichment.
- [Introducing sbomify: Revolutionizing SBOM Management](https://sbomify.com/2024/08/29/launching-sbomify/) (2024-08-29): Announcing the launch of sbomify, a platform for automated SBOM management and sharing that integrates with CI/CD pipelines to ensure stakeholders always have the latest SBOMs.
- [Exploring the Future of Software Security: Join Us at BSides Bristol](https://sbomify.com/2024/08/26/bsides-bristol/) (2024-08-26): sbomify presents 'Navigating the SBOM Landscape: Formats, Relevance, and Tooling in 2024' at BSides Bristol, covering SPDX, CycloneDX, and current SBOM tooling.
- [Announcing sbomify's GitHub Actions Module: Seamlessly Share SBOMs in Your CI/CD Pipeline](https://sbomify.com/2024/08/21/introducing-github-action-module/) (2024-08-21): Introducing sbomify's GitHub Actions module for automated SBOM generation in your CI/CD pipeline. Available on GitHub Marketplace for seamless integration.
- [Comparing SBOM Formats: Focus on Component Types in CycloneDX vs. SPDX](https://sbomify.com/2024/08/20/sbom-component-types/) (2024-08-20): A detailed comparison of CycloneDX and SPDX SBOM formats, analyzing their support for applications, libraries, containers, operating systems, and SaaS components.
- [What Is SLSA? Understanding Supply Chain Levels for Software Artifacts](https://sbomify.com/2024/08/17/what-is-slsa/) (2024-08-17): What is SLSA? The OpenSSF framework for software supply chain security defines three build levels for provenance and integrity. Learn how SLSA works, how it builds on in-toto, and how to adopt it with GitHub Actions.
- [What Is in-toto? Securing the Software Supply Chain End to End](https://sbomify.com/2024/08/14/what-is-in-toto/) (2024-08-14): What is in-toto? The CNCF-graduated framework uses layouts, signed link metadata, and end-to-end verification to cryptographically prove every build step happened as intended. Learn how it underpins SLSA, GitHub attestations, and SBOM integrity.
- [What Is Sigstore? Keyless Signing for the Software Supply Chain](https://sbomify.com/2024/08/12/what-is-sigstore/) (2024-08-12): What is Sigstore? The CNCF-graduated project makes cryptographic signing effortless with keyless signing via Fulcio, transparency logging via Rekor, and container signing via Cosign. Learn how Sigstore secures artifacts, SBOMs, and supply chains.
- [How to Generate SBOMs for Python Packages with `pipdeptree` and `cyclonedx-py`](https://sbomify.com/2024/07/30/generate-sboms-for-python-packages-with-pipdeptree-and-cyclonedx-py/) (2024-07-30): Tutorial on generating CycloneDX SBOMs for Python projects using pipdeptree and cyclonedx-py, including transitive dependencies and best practices for pinning with hashes.
- [What Is Lock File Drift? A Hidden Risk in Dependency Management](https://sbomify.com/2024/07/30/what-is-lock-file-drift/) (2024-07-30): What is lock file drift? When your dependency manifest and lock file fall out of sync, builds become unreproducible and SBOMs become inaccurate. Learn how to detect, prevent, and fix lock file drift across npm, Python, Go, Rust, and more.
- [Embracing Cybersecurity with CISA's 'Secure by Design' Initiative](https://sbomify.com/2024/07/24/embracing-cybersecurity-with-cisas-secure-by-design-initiative/) (2024-07-24): Overview of CISA's Secure by Design guide, its three core principles for software manufacturers, and practical steps for implementing security from the start.
- [What's New in SPDX 3: Enhanced Referencing Capabilities](https://sbomify.com/2024/07/22/whats-new-in-spdx-3-enhanced-referencing-capabilities/) (2024-07-22): SPDX 3 draft introduces nested references, cross-document references, and improved relationship types to match CycloneDX capabilities for complex SBOM management.
- [The Role of SBOMs in an OBOM: Ensuring Compliance and Security in Smart Thermometer Development](https://sbomify.com/2024/07/09/the-role-of-sboms-in-an-obom-ensuring-compliance-and-security-in-smart-thermometer-development/) (2024-07-09): How to integrate SBOMs into Operations Bill of Materials (OBOM) for IoT devices, using a smart thermometer example with Python backend, Docker, and Rust firmware.
- [Enhancing Dependency Management with GitHub's Dependency Graph: An Analysis](https://sbomify.com/2024/06/24/enhancing-dependency-management-with-githubs-dependency-graph-an-analysis/) (2024-06-24): Research analysis revealing inaccuracies in GitHub's dependency graph for Java and Python projects, with implications for Dependabot and SBOM generators.
- [Framing Software Component Transparency: Establishing a Common Software Bill of Materials (SBOM)](https://sbomify.com/2024/06/11/framing-software-component-transparency-establishing-a-common-software-bill-of-materials-sbom/) (2024-06-11): Summary of NTIA's SBOM Framing document 2nd edition highlighting transparency, interoperability standards, and what to expect in the upcoming 3rd edition.
- [Get the latest SBOMs from the top 15 most popular images on Docker Hub](https://sbomify.com/2024/06/04/get-the-latest-sboms-from-the-top-15-most-popular-images-on-docker-hub/) (2024-06-04): Automated nightly SBOM generation for Docker Hub's top 15 images including nginx, postgres, redis, and node using Syft in GitHub Actions CI/CD pipeline.
- [Comprehensive Guide to Generating and Understanding SBOMs with Docker and Django-CMS](https://sbomify.com/2024/05/27/comprehensive-guide-to-generating-and-understanding-sboms-with-docker-and-django-cms/) (2024-05-27): Practical walkthrough of generating SBOMs from Docker containers and Python projects using Django-CMS as an example, covering cyclonedx-python, docker sbom, and transitive dependencies.
- [Call for Views on the Code of Practice for Software Vendors: Ensuring Security and Resilience](https://sbomify.com/2024/05/26/call-for-views-on-the-code-of-practice-for-software-vendors-ensuring-security-and-resilience/) (2024-05-26): UK government launches consultation on voluntary Code of Practice for Software Vendors to enhance security and resilience of digital products sold to businesses.
- [Enhancing SBOM Sharing: A Look at Current Practices and the Role of sbomify](https://sbomify.com/2024/05/13/enhancing-sbom-sharing-a-look-at-current-practices-and-the-role-of-sbomify/) (2024-05-13): Analysis of CISA's SBOM Sharing Primer examining current SBOM sharing methods from email to automated tooling, and how sbomify simplifies the distribution process.
- [Understanding ISO 42001 and the Integration of SBOMs for Enhanced Operational Resilience](https://sbomify.com/2024/05/02/understanding-iso-42001-and-the-integration-of-sboms-for-enhanced-operational-resilience/) (2024-05-02): How to integrate SBOMs with ISO 42001 operational resilience management systems for better risk assessment, incident response, and compliance.
- [Harnessing ISO 27001 and SBOMs for Enhanced Information Security Management](https://sbomify.com/2024/04/29/harnessing-iso-27001-and-sboms-for-enhanced-information-security-management/) (2024-04-29): How to integrate SBOMs into ISO 27001 information security management systems for better risk assessment, compliance auditing, and vendor management.
- [Exploring the New SPDX 3.0: A Game Changer for SBOMs](https://sbomify.com/2024/04/28/exploring-the-new-spdx-3-0-a-game-changer-for-sboms/) (2024-04-28): Overview of SPDX 3.0 improvements including enhanced compatibility, improved accuracy, streamlined automation, and broader software package support for SBOM generation.
- [What Is OpenSSF? Scorecards, SLSA, and the Open Source Security Ecosystem](https://sbomify.com/2024/04/25/openssf-and-openssf-scorecards-bolstering-open-source-security/) (2024-04-25): What is OpenSSF? The Open Source Security Foundation coordinates industry-wide efforts to secure open source software. Learn about OpenSSF Scorecards, how to run them, what they measure, and how they connect to SBOMs, SLSA, and supply chain security.
- [How SBOMs Streamline SOC 2 Compliance: Insights for the Agile Enterprise](https://sbomify.com/2024/04/23/how-sboms-streamline-soc-2-compliance-insights-for-the-agile-enterprise/) (2024-04-23): Guide on using SBOMs to simplify SOC 2 Type I and Type II compliance through improved transparency, proactive risk management, and streamlined audits.
- [What really happened to XZ?](https://sbomify.com/2024/04/13/what-really-happened-to-xz/) (2024-04-13): Analysis of the XZ backdoor discovery in Linux distributions, exploring how this supply chain attack worked and the implications for open-source security.
- [Elevate Your Cybersecurity with Our Leading SBOM Management Solution](https://sbomify.com/2024/04/12/elevate-your-cybersecurity-with-our-leading-sbom-management-solution/) (2024-04-12): How sbomify's SBOM management platform helps organizations comply with Executive Order 14028 through comprehensive visibility, vulnerability management, and streamlined reporting.
- [NIST Cybersecurity Framework (CSF) 2.0: What It Means for Software Supply Chain Security](https://sbomify.com/2024/04/11/introducing-the-nist-cybersecurity-framework-csf-2-0/) (2024-04-11): A practical guide to NIST CSF 2.0, its six core functions including the new GOVERN function, and how SBOMs support CSF 2.0 implementation for supply chain risk management and vulnerability monitoring.
- [What Is a CBOM? The Cryptography Bill of Materials Explained](https://sbomify.com/2024/04/10/future-proofing-cybersecurity-with-the-cryptography-bill-of-materials-cbom/) (2024-04-10): What is a CBOM? The Cryptography Bill of Materials inventories every cryptographic asset in your software – algorithms, keys, certificates, and protocols. Learn how CBOMs prepare organizations for the post-quantum transition.
- [How to create an SBOM](https://sbomify.com/2024/04/07/how-to-create-an-sbom/) (2024-04-07): Step-by-step guide to generating SBOMs using Docker CLI and GitHub tools including the command line interface, Dependency Graph, and REST API.
- [Elevating M&A Due Diligence with SBOMs: A Guide for Corporate Strategists](https://sbomify.com/2024/04/07/elevating-ma-due-diligence-with-sboms-a-guide-for-corporate-strategists/) (2024-04-07): How SBOMs accelerate M&A due diligence compared to traditional source code analysis with Black Duck, offering faster evaluation, IP protection, and streamlined compliance.
- [Elevating M&A Due Diligence with sbomify's SBOM Management](https://sbomify.com/2024/04/03/elevating-ma-due-diligence-with-sbomifys-sbom-management/) (2024-04-03): How sbomify streamlines M&A due diligence by providing comprehensive software asset evaluation, vulnerability assessment, and license compliance checking.
- [Streamlining Open Source License Compliance in M&A: Unveiling the sbomify Advantage](https://sbomify.com/2024/04/03/streamlining-open-source-license-compliance-in-ma-unveiling-the-sbomify-advantage/) (2024-04-03): Learn how sbomify simplifies open source license compliance during M&A due diligence by automating SBOM analysis to identify GPLv3 and other non-permissive licenses.
- [The Time is Now: Embracing SBOMs in an Era of Enhanced Cybersecurity Standards](https://sbomify.com/2024/04/03/the-time-is-now-embracing-sboms-in-an-era-of-enhanced-cybersecurity-standards/) (2024-04-03): Why 2024-2026 is the critical window for SBOM adoption. From EO 14028 and the EU Cyber Resilience Act to PCI DSS 4.0 and FDA guidance, regulatory requirements are converging – and the tooling is ready.
- [SBOM Management for Software Vendors: A Complete Guide to sbomify](https://sbomify.com/2024/04/03/sbomify-a-paradigm-shift-for-software-vendors-in-sbom-management/) (2024-04-03): How software vendors use sbomify to generate compliance-ready SBOMs in CI/CD, enrich them with 11 data sources, attest with GitHub Actions, and share via Trust Center – all from an open source GitHub Action.
- [Navigating the Landscape of Open Source Licenses](https://sbomify.com/2024/04/03/navigating-the-landscape-of-open-source-licenses/) (2024-04-03): Comprehensive guide to open source licenses including MIT, Apache 2.0, GPL, BSD, MPL, and more. Learn the differences between permissive and copyleft licenses and how SBOMs help with license compliance.
- [Enhancing SBOM Management for Software Buyers with sbomify](https://sbomify.com/2024/04/03/enhancing-sbom-management-for-buyers-with-sbomify/) (2024-04-03): How sbomify helps CTOs and CISOs manage SBOMs from software vendors – with Trust Center access, vulnerability monitoring, license compliance, and SBOM hierarchy for complex supply chains.
- [Demystifying SBOMs: The Backbone of Modern Software Security](https://sbomify.com/2024/04/03/demystifying-sboms-the-backbone-of-modern-software-security/) (2024-04-03): What is an SBOM? A Software Bill of Materials is a machine-readable inventory of every component in your software. Learn about SBOM formats (SPDX, CycloneDX), generation tools, vulnerability management, and compliance requirements.

---

From sbomify: https://sbomify.com/blog/