sbomify logo

SBOM Resources

The SBOM life cycle can be broken down into three phases: generation, collaboration, and analysis. The structure below aligns with the life cycle.

There’s also a GitHub repository called sbom-benchmarks that sets to benchmark the various tools (from the Generation phase) against each other, along with providing examples how they are used.

Generation

The generation phase is where you create an SBOM from a source. There are various strategies for generating SBOMs, but this phase generally involves taking a set of inputs (such as a dependency file) and generating an SBOM in either the CycloneDX or SPDX format.

Generic

Tools that spans multiple formats and languages.

Specific

Language or format-specific tools.

Docker / Containers

You can see how they compare side-by-side in the sbom-benchmark repository.

  • Tern
  • bom from The Linux Foundation

Python

You can see how they compare side-by-side in the sbom-benchmark repository.

Rust

Go

.NET

Java

JavaScript

Others

Assembly and Enrichment

Collaboration

The collaboration phase focuses on how you share the SBOM with internal and external stakeholders.

Analysis

The analysis phase involves how you use the SBOM, typically for compliance or security purposes. Mature organizations may use multiple tools or services for different purposes.

Other SBOM resources

Edit me on GitHub