sbomify logo

SBOM Resources

Discover the full SBOM life cycle: Generation, Distribution, and Analysis. Explore tools, benchmarks, and resources for creating, sharing, and utilizing Software Bills of Materials.

New to SBOMs? Start with What is an SBOM? to learn the basics.

The SBOM life cycle can be broken down into three phases: generation, distribution, and analysis. The structure below aligns with the life cycle.

Lifecycle

There’s also a GitHub repository called sbom-benchmarks that sets to benchmark the various tools (from the Generation phase) against each other, along with providing examples how they are used.

For step-by-step guides on generating SBOMs for specific languages and platforms, see our comprehensive SBOM Guides.

Video Resources

Introduction to SBOMs: sbomify at Ubuntu Engineering Sprint

Interview with the creator of CycloneDX: Steve Springett

Interview with “the father of SBOMs”: Allan Friedman

A deep dive into the SBOM format SPDX

CRA deep dive with Sarah Fluchs

Generation / Authoring

The SBOM generation phase, also known as authoring, is where you create an SBOM from a source. There are various strategies for generating SBOMs, but this phase generally involves taking a set of inputs (such as a dependency file) and generating an SBOM in either the CycloneDX or SPDX format.

Generic

Tools that spans multiple formats and languages.

Specific

Language or format-specific tools.

Docker / Containers

See guide SBOM Generation Guide for Docker and Containers for more details.

You can see how they compare side-by-side in the sbom-benchmark repository.

  • bom from The Linux Foundation
  • Tern

Python

See guide The ultimate SBOM guide for Python for more language specific details.

You can see how they compare side-by-side in the sbom-benchmark repository.

Rust

See guide SBOM Generation Guide for Rust - Cargo for more language specific details.

Go

See guide SBOM Generation Guide for Go - Go Modules for more language specific details.

.NET

See guide SBOM Generation Guide for .NET - NuGet for more language specific details.

Java

See guide SBOM Generation Guide for Java - Maven, Gradle for more language specific details.

JavaScript

See guide SBOM Generation Guide for JavaScript - npm, yarn, pnpm, Bun for more language specific details.

Ruby

See guide SBOM Generation Guide for Ruby - Bundler for more language specific details.

PHP

See guide SBOM Generation Guide for PHP - Composer for more language specific details.

Swift

See guide SBOM Generation Guide for Swift - Swift Package Manager for more language specific details.

Dart / Flutter

See guide SBOM Generation Guide for Dart and Flutter - pub for more language specific details.

Elixir

See guide SBOM Generation Guide for Elixir - Mix for more language specific details.

Scala

See guide SBOM Generation Guide for Scala - sbt for more language specific details.

C/C++

See guide SBOM Generation Guide for C/C++ - Conan for more language specific details.

Related blog posts by Chris Swan:

Terraform

See guide SBOM Generation Guide for Terraform - Infrastructure as Code for more language specific details.

Yocto

See guide SBOM Generation Guide for Yocto - Embedded Linux for more details.

Related blog posts:

Raspberry Pi

See guide SBOM Generation Guide for Raspberry Pi - rpi-image-gen for more details.

Related blog posts:

Others

Assembly and Enrichment

Distribution / Transportation

The distribution phase, also known as Transportation, focuses on how you share the SBOM with internal and external stakeholders.

Analysis

The analysis phase involves how you use the SBOM, typically for compliance or security purposes. Mature organizations may use multiple tools or services for different purposes.

Compliance & Standards

For detailed information on SBOM compliance requirements across NTIA, CISA, EU CRA, FDA, and schema mappings to CycloneDX/SPDX, see our SBOM Compliance Requirements page.

Edit this page on GitHub