# SBOM Resources > Discover the full SBOM life cycle: Generation, Distribution, and Analysis. Explore tools, benchmarks, and resources for creating, sharing, and utilizing Software Bills of Materials. - **Updated:** 2026-10-23 New to SBOMs? Start with [What is an SBOM?](https://sbomify.com/what-is-sbom/) to learn the basics. The SBOM life cycle can be broken down into three phases: [generation, distribution, and analysis](https://sbomify.com/features/generate-collaborate-analyze/). The structure below aligns with the life cycle. ![Lifecycle](https://sbomify.com/assets/images/d2/lifecycle.svg) There's also a GitHub repository called [sbom-benchmarks](https://github.com/sbomify/sbom-benchmarks) that sets to benchmark the various tools (from the Generation phase) against each other, along with providing examples how they are used. For step-by-step guides on generating SBOMs for specific languages and platforms, see our comprehensive [SBOM Guides](https://sbomify.com/guides/). **Related educational content:** - [SBOM Generation Tools Compared](https://sbomify.com/2026/01/26/sbom-generation-tools-comparison/) – In-depth comparison of Syft, Trivy, cdxgen, and more - [Trivy Compromise: Hardening sbomify-action](https://sbomify.com/2026/03/26/trivy-compromise-hardening-sbomify-action/) – March 2026 supply chain advisory - [SBOM Formats: CycloneDX vs SPDX](https://sbomify.com/2026/01/15/sbom-formats-cyclonedx-vs-spdx/) – Choosing the right format for your use case - [SBOM Scanning: Vulnerability Detection](https://sbomify.com/2026/02/01/sbom-scanning-vulnerability-detection/) – How to scan SBOMs for known vulnerabilities - [SBOM Management Best Practices](https://sbomify.com/2026/01/18/sbom-management-best-practices/) – Organizing, monitoring, and acting on SBOMs at scale --- ## Video Resources ### CRA-Ready SBOMs: A Practical Blueprint for High-Quality Generation Video: [CRA-Ready SBOMs: A Practical Blueprint for High-Quality Generation](https://video.fosdem.org/2026/ud2208/UYTGWA-sbom-generation.av1.webm). A four-phase SBOM generation model addressing the EU's Cyber Resilience Act requirements, covering authoring, augmenting, enriching, and signing SBOMs to exceed minimal compliance standards. See also the [FOSDEM schedule page](https://fosdem.org/2026/schedule/event/UYTGWA-sbom-generation/) for more details. ### Introduction to SBOMs: sbomify at Ubuntu Engineering Sprint Video: [sbomify at Ubuntu Engineering Sprint](https://www.youtube.com/watch?v=5mlR1lPz1no). Introduction to SBOMs and sbomify presented at the Ubuntu Engineering Sprint. ### Interview with the creator of CycloneDX: Steve Springett Video: [SBOMs, CycloneDX, and Software Security with Steve Springett](https://www.youtube.com/watch?v=oSBDSJf0FeA). Exploring the world of software security and compliance with Steve Springett, diving into how SBOMs and CycloneDX are reshaping how we track and secure our software supply chains. ### Interview with "the father of SBOMs": Allan Friedman Video: [SBOMs and Cybersecurity: A Deep Dive with Allan Friedman](https://www.youtube.com/watch?v=E77ohYZA2vo). An in-depth discussion about SBOMs with Allan Friedman, formerly of CISA. ### A deep dive into the SBOM format SPDX Video: [A deep dive into the SBOM format SPDX with Kate Stewart and Gary O'Neall](https://www.youtube.com/watch?v=fJS7_VO_Was). Exploring the evolution and impact of SPDX in software transparency with Kate Stewart from the Linux Foundation and Gary O'Neall, a long-time SPDX contributor. ### CRA deep dive with Sarah Fluchs Video: [CRA Explained: What the Cyber Resilience Act Means for Device Manufacturers](https://www.youtube.com/watch?v=e9_bpsJKOL0). Podcast episode with EU CRA expert Sarah Fluchs explaining SBOM requirements, the 5-year support mandate, and vulnerability management for device manufacturers. ### SBOMs & CRA Deep Dive: Compliance, Liability & the Future of Secure Products Video: [SBOMs & CRA Deep Dive: Compliance, Liability & the Future of Secure Products](https://www.youtube.com/watch?v=EIBj-eVlu80). A deep dive into SBOMs and the EU Cyber Resilience Act, covering compliance obligations, liability implications, and what the future of secure products looks like. ### How SBOMs and Engineering Discipline Can Help You Avoid Trivy's Compromise Video: [How SBOMs and Engineering Discipline Can Help You Avoid Trivy's Compromise](https://www.youtube.com/watch?v=thfUpenosBs). InfoQ podcast episode with Viktor Petersson on how SBOMs and engineering discipline help teams detect and respond to supply chain compromises like the March 2026 Trivy incident. Also available on [Spotify](https://open.spotify.com/episode/5wzJM6Sk3ZRbvC8sfmFBPb) and [Apple Podcasts](https://podcasts.apple.com/gb/podcast/how-sboms-and-engineering-discipline-can-help-you/id1106971805?i=1000761075185). --- ## Articles & Press - [QCon London 2026: SBOMs Move from Best Practice to Legal Obligation as CRA Enforcement Looms](https://www.infoq.com/news/2026/03/sbom-viktor-petersson/) – InfoQ coverage of Viktor Petersson's QCon London 2026 talk on how the EU CRA and existing US regulations are turning SBOMs into a mandatory compliance requirement. - [U.S. Army, Lockheed Martin detail SBOM progress](https://www.techtarget.com/searchitoperations/feature/366611692/US-Army-Lockheed-Martin-detail-SBOM-progress) – TechTarget reporting on how the U.S. Army and Lockheed Martin are operationalizing SBOMs, with commentary from sbomify. - [Cybersecurity Legislation Driving SBOMs](https://www.eetimes.eu/cybersecurity-legislation-driving-sboms/) – EE Times Europe on how cybersecurity legislation is driving SBOM adoption. --- ## Generation / Authoring The SBOM generation phase, also known as authoring, is where you create an SBOM from a source. There are various strategies for generating SBOMs, but this phase generally involves taking a set of inputs (such as a dependency file) and generating an SBOM in either the [CycloneDX](https://cyclonedx.org/) or [SPDX](https://spdx.dev/) format. ### Generic Tools that spans multiple formats and languages. - [sbomify GitHub Action](https://github.com/sbomify/sbomify-action/) from sbomify - [Snyk](https://github.com/snyk/cli) from Snyk - [Syft](https://github.com/anchore/syft) from Anchore - ~~[Trivy](https://github.com/aquasecurity/trivy) from Aqua~~ ([removed from sbomify-action](https://sbomify.com/2026/03/26/trivy-compromise-hardening-sbomify-action/) following its March 2026 compromise) ### Specific Language or format-specific tools. #### Docker / Containers See guide [SBOM Generation Guide for Docker and Containers](https://sbomify.com/guides/docker/) for more details. You can see how they compare side-by-side in the [sbom-benchmark](https://github.com/sbomify/sbom-benchmarks/tree/master/docker) repository. - [bom](https://github.com/kubernetes-sigs/bom) from The Linux Foundation - [Tern](https://github.com/tern-tools/tern) #### Python See guide [The ultimate SBOM guide for Python](https://sbomify.com/guides/python/) for more language specific details. You can see how they compare side-by-side in the [sbom-benchmark](https://github.com/sbomify/sbom-benchmarks/tree/master/python) repository. - [CycloneDX Python](https://github.com/CycloneDX/cyclonedx-python) from CycloneDX - [sbom4python](https://github.com/anthonyharrison/sbom4python) from Anthony Harrison - [SPDX Python](https://github.com/spdx/tools-python) from SPDX #### Rust See guide [SBOM Generation Guide for Rust - Cargo](https://sbomify.com/guides/rust/) for more language specific details. - [CycloneDX Rust](https://github.com/CycloneDX/cyclonedx-rust-cargo) from CycloneDX - [sbom-rs](https://github.com/psastras/sbom-rs) from Paul Sastrasinh - [sbom4rust](https://github.com/anthonyharrison/sbom4rust) from Anthony Harrison #### Go See guide [SBOM Generation Guide for Go - Go Modules](https://sbomify.com/guides/go/) for more language specific details. - [CycloneDX Go](https://github.com/CycloneDX/cyclonedx-gomod) from CycloneDX - [SPDX Golang](https://github.com/spdx/tools-golang) from SPDX #### .NET See guide [SBOM Generation Guide for .NET - NuGet](https://sbomify.com/guides/dotnet/) for more language specific details. - [CycloneDX .NET](https://github.com/CycloneDX/cyclonedx-dotnet-library) from CycloneDX - [SBOM Tool](https://github.com/microsoft/sbom-tool) from Microsoft #### Java See guide [SBOM Generation Guide for Java - Maven, Gradle](https://sbomify.com/guides/java/) for more language specific details. - [CycloneDX Java](https://github.com/CycloneDX/cyclonedx-core-java) from CycloneDX - [SPDX Java](https://github.com/spdx/Spdx-Java-Library) from SPDX #### JavaScript See guide [SBOM Generation Guide for JavaScript - npm, yarn, pnpm, Bun](https://sbomify.com/guides/javascript/) for more language specific details. - [CycloneDX JavaScript](https://github.com/CycloneDX/cyclonedx-javascript-library) - [Retire.js](https://github.com/RetireJS/retire.js) from RetireJS - [sbom4js](https://github.com/anthonyharrison/sbom4js) from Anthony Harrison #### Ruby See guide [SBOM Generation Guide for Ruby - Bundler](https://sbomify.com/guides/ruby/) for more language specific details. - [CycloneDX Ruby](https://github.com/CycloneDX/cyclonedx-ruby-gem) from CycloneDX #### PHP See guide [SBOM Generation Guide for PHP - Composer](https://sbomify.com/guides/php/) for more language specific details. - [CycloneDX PHP Composer](https://github.com/CycloneDX/cyclonedx-php-composer) from CycloneDX #### Swift See guide [SBOM Generation Guide for Swift - Swift Package Manager](https://sbomify.com/guides/swift/) for more language specific details. #### Dart / Flutter See guide [SBOM Generation Guide for Dart and Flutter - pub](https://sbomify.com/guides/dart/) for more language specific details. #### Elixir See guide [SBOM Generation Guide for Elixir - Mix](https://sbomify.com/guides/elixir/) for more language specific details. #### Scala See guide [SBOM Generation Guide for Scala - sbt](https://sbomify.com/guides/scala/) for more language specific details. #### C/C++ See guide [SBOM Generation Guide for C/C++ - Conan](https://sbomify.com/guides/cpp/) for more language specific details. Related blog posts by [Chris Swan](https://sbomify.com/authors/cswan/): - [The C conundrum - generating SBOMs when there's no lockfile](https://sbomify.com/2024/11/18/c-conundrum/) - [Using Conan for C SBOMs](https://sbomify.com/2025/09/04/conan/) #### Terraform See guide [SBOM Generation Guide for Terraform - Infrastructure as Code](https://sbomify.com/guides/terraform/) for more language specific details. #### Yocto See guide [SBOM Generation Guide for Yocto - Embedded Linux](https://sbomify.com/guides/yocto/) for more details. Related blog posts: - [Mastering SBOM Generation with Yocto](https://sbomify.com/2025/02/21/mastering-sbom-generation-with-yocto/) #### Raspberry Pi See guide [SBOM Generation Guide for Raspberry Pi - rpi-image-gen](https://sbomify.com/guides/raspberry-pi/) for more details. Related blog posts: - [Unpacking Raspberry Pi's Built-In SBOM Magic](https://sbomify.com/2025/04/17/unpacking-raspberry-pi-s-built-in-sbom-magic/) #### Others - [Hoppr](https://hoppr.dev/) from Lockheed Martin Corporation - [OSS Review Toolkit](https://github.com/oss-review-toolkit/ort) (ORT) - [protobom](https://github.com/protobom/protobom) ### Assembly and Enrichment - [CycloneDX Editor/Validator](https://github.com/Festo-se/cyclonedx-editor-validator/) from Festo - [jq](https://github.com/jqlang/jq) is commonly used for assembly - [Parlay](https://github.com/snyk/parlay) from Snyk - [sbomasm](https://github.com/interlynk-io/sbomasm) from Interlynk - [sbomaudit](https://github.com/anthonyharrison/sbomaudit) from Anthony Harrison --- ## Distribution / Transportation The distribution phase, also known as Transportation, focuses on how you share the SBOM with internal and external stakeholders. - [sbomify]() - [Project Koala](https://github.com/CycloneDX/transparency-exchange-api) (a.k.a. Transparency Exchange API) from CycloneDX --- ## Analysis The analysis phase involves how you use the SBOM, typically for compliance or security purposes. Mature organizations may use multiple tools or services for different purposes. - [bomber](https://github.com/devops-kung-fu/bomber) from DKFM - [bomshell](https://github.com/puerco/bomshell) from Adolfo García Veytia (a.k.a. Puerco) - [Cybellum](https://cybellum.com/) from Cybellum - [Dependency Track](https://dependencytrack.org/) from OWASP - [Eclipse SW360](https://github.com/eclipse-sw360/sw360) - [Grype](https://github.com/anchore/grype) from Anchore - [GUAC](https://guac.sh) from OpenSSF - [Helm](https://www.medcrypt.com/solutions/helm) from Medcrypt - [NTIA Conformance Checker](https://github.com/spdx/ntia-conformance-checker) from SPDX - [Open Source Vulnerabilities](https://osv.dev/) (OSV) from Google - [SBOM Observer](https://sbom.observer/) from Bitfront - [sbomaudit](https://github.com/anthonyharrison/sbomaudit) from Anthony Harrison - [sbommerge](https://github.com/anthonyharrison/sbommerge) from Anthony Harrison - [sbomqs](https://github.com/interlynk-io/sbomqs) from Interlynk - [sbom-tools](https://github.com/sbom-tool/sbom-tools) from sbom-tool - [SecObserve](https://github.com/SecObserve/SecObserve) from Stefan Fleckenstein --- ## Compliance & Standards For detailed information on SBOM compliance requirements across NTIA, CISA, EU CRA, FDA, and schema mappings to CycloneDX/SPDX, see our [SBOM Compliance Requirements](https://sbomify.com/compliance/) page. **External resources:** - [OpenChain CRA Compliance](https://openchainproject.org/cracompliance) – The OpenChain Project's CRA requirement and self-certification checklist, developed in the open on [GitHub](https://github.com/OpenChain-Project/CRA-Compliance) and building on ISO/IEC 18974 (open source security assurance). Where [BSI TR-03183-2](https://sbomify.com/compliance/bsi-tr-03183/) specifies what a CRA-ready SBOM must contain, OpenChain's checklist covers the process and policy side of getting an organisation ready. The two complement each other. - [Open Regulatory Compliance Working Group (ORC WG)](https://orcwg.org/) – Hosted by the Eclipse Foundation, ORC WG is where open source foundations, maintainers, and industry work out what the CRA means for open source in practice. Its [CRA Hub](https://github.com/orcwg/cra-hub) collects an FAQ, a resource inventory, a summary of the requested harmonised standards, and input on the important and critical product categories. Start here if you are working out whether you are an **open-source steward** under [CRA Article 24](https://sbomify.com/compliance/eu-cra/) rather than a manufacturer. [Edit this page on GitHub](https://github.com/sbomify/sbomify.com/blob/master/resources.md) --- From sbomify: https://sbomify.com/resources/