# From Zero to SBOM Hero

> Generate your first compliance-ready SBOM in under 5 minutes. A quick-start guide to SBOM generation, quality, and distribution.

- **Updated:** 2026-10-28

![Diagram: zero to hero](https://sbomify.com/assets/images/d2/zero-to-hero.svg)

```d2
Zero: {
  label: "Zero"
}
Learn: {
  label: "Learn"
}
Generate: {
  label: "Generate"
}
Manage: {
  label: "Manage"
}
Hero: {
  label: "Hero"
}
Zero -> Learn
Learn -> Generate
Generate -> Manage
Manage -> Hero
```

---

## The Quality Problem

Most SBOM generation tools produce incomplete SBOMs that:

- Miss critical metadata (supplier info, licenses, contact details)
- Lack unique identifiers (PURLs, CPEs) needed for vulnerability matching
- Don't capture transitive dependencies properly
- Fail to meet compliance requirements

### Why Quality Matters

- **Vulnerability insights**: Without proper identifiers, you can't match components to CVE databases
- **EOL detection**: Can't identify end-of-life components without enriched metadata
- **License compliance**: Missing license data means legal blind spots
- **Compliance failures**: [NTIA minimum elements](https://sbomify.com/compliance/ntia-minimum-elements/), [CISA requirements](https://sbomify.com/compliance/cisa-minimum-elements/), and [EU CRA](https://sbomify.com/compliance/eu-cra/) all set quality bars that raw generation tools don't meet

![Diagram: quality gap](https://sbomify.com/assets/images/d2/quality-gap.svg)

```d2
SBOM: {
  label: "Your SBOM"
}
Lockfile: {
  label: "Your Lockfile"
}
Action: {
  label: "sbomify action"
}
Quality: {
  label: "Quality SBOM"
}
SBOM -> Action: "or"
Lockfile -> Action
Action -> Quality
```

### The sbomify Difference

The [sbomify action](https://github.com/sbomify/sbomify-action) is **fully open source** and produces SBOMs that meet NTIA, CISA and BSI TR-03183 field requirements out of the box by automatically:

- Augmenting with supplier/author/manufacturer metadata
  - Data comes from your [sbomify profile](https://app.sbomify.com/) or a `sbomify.json` file in your repo
- Enriching from **12 data sources** including:
  - Pre-computed databases (LicenseDB, Lifecycle Database for EOL dates)
  - Native registries (PyPI, crates.io, pub.dev, Debian)
  - Aggregators (deps.dev, ecosyste.ms)
  - Fallback sources (ClearlyDefined, Repology)
- Adding proper identifiers for vulnerability matching
- Meeting NTIA minimum elements without manual intervention

See [Integrations](https://sbomify.com/features/integrations/) for the full list of enrichment sources.

![Diagram: sbomify action flow](https://sbomify.com/assets/images/d2/sbomify-action-flow.svg)

```d2
Input: {
  label: "Your Code"
}
Action: {
  label: "sbomify action"
  Generate: {
    label: "Generate"
  }
  Augment: {
    label: "Augment"
  }
  Enrich: {
    label: "Enrich"
  }
  Generate -> Augment
  Augment -> Enrich
}
Outputs: {
  label: ""
  Quality: {
    label: "Compliance-Ready"
  }
  Compliance: {
    label: "Regulation Checks"
  }
  Attestation: {
    label: "Verify Attestation"
  }
}
Input -> Action.Generate
Action.Enrich -> Outputs.Quality
Outputs.Quality -> Outputs.Compliance
Outputs.Quality -> Outputs.Attestation
```

### Runs Anywhere - No Vendor Lock-in

- **GitHub Actions** - Native integration
- **Any CI/CD** - GitLab CI, Bitbucket Pipelines, Jenkins, CircleCI, Travis CI, etc.
- **Python package** - `uvx sbomify-action` for standalone use
- **Docker** - `ghcr.io/sbomify/sbomify-action` runs anywhere

### Deployment Flexibility

- **Hosted by sbomify** - SaaS, we manage everything
- **Self-hosted** - Run on your own infrastructure for full control, keep your SBOMs in-house, and avoid dependency on any external vendor

Your SBOMs, your infrastructure, your choice. Use the action standalone or with the sbomify platform.

---

## Step-by-Step Guide

### Step 1: Understand the Basics

A Software Bill of Materials (SBOM) is like the ingredients list on a food package - but for software. It documents every component, library, and dependency in your application.

![Diagram: what is sbom](https://sbomify.com/assets/images/d2/what-is-sbom.svg)

```d2
Software Product: {
  label: "Modern Application"
  Transitive: {
    label: "Transitive Dependencies"
  }
  Open Source: {
    label: "Open Source Libraries"
  }
  Source Code: {
    label: "Your Source Code"
  }
  Transitive -> Open Source: "included in"
  Open Source -> Source Code: "included in"
}
SBOM: {
  label: "SBOM\n(Ingredients List)"
}
Software Product -> SBOM: "Cataloged by"
```

**Key takeaway:** SBOMs catalog all your dependencies, but **quality matters**. A low-quality SBOM is like an incomplete ingredients list - worse than useless because it gives false confidence.

[What is an SBOM? →](https://sbomify.com/what-is-sbom/)

### Step 2: Choose Your Stack

sbomify supports all major ecosystems:

| Language/Platform                 | Package Managers        |
| --------------------------------- | ----------------------- |
| [Python](https://sbomify.com/guides/python/)         | pip, Poetry, Pipenv, uv |
| [JavaScript](https://sbomify.com/guides/javascript/) | npm, yarn, pnpm, Bun    |
| [Java](https://sbomify.com/guides/java/)             | Maven, Gradle           |
| [Go (Golang)](https://sbomify.com/guides/go/)        | Go Modules              |
| [Rust](https://sbomify.com/guides/rust/)             | Cargo                   |
| [Ruby](https://sbomify.com/guides/ruby/)             | Bundler                 |
| [PHP](https://sbomify.com/guides/php/)               | Composer                |
| [.NET/C#](https://sbomify.com/guides/dotnet/)        | NuGet                   |
| [Docker](https://sbomify.com/guides/docker/)         | Container images        |

[View all guides →](https://sbomify.com/guides/)

### Step 3: Generate a Compliance-Ready SBOM

Choose the option that fits your environment:

**Setup wizard** (quickest)

```bash
docker run --rm -it \
  -v "$(pwd):/github/workspace" \
  -w /github/workspace \
  ghcr.io/sbomify/sbomify-action \
  sbomify-action wizard
```

The interactive [setup wizard](https://sbomify.com/faq/how-do-i-use-the-sbomify-setup-wizard/) scans your repo for lockfiles, creates your product and components in sbomify, registers [OIDC trusted publishing](https://sbomify.com/faq/how-do-i-set-up-oidc-trusted-publishing/) (so you never store a token secret), and writes a ready-to-commit `.github/workflows/sboms.yml`.

**GitHub Actions** (manual setup)

```yaml
- name: Generate SBOM
  uses: sbomify/sbomify-action@master
  env:
    LOCK_FILE: 'requirements.txt'
    OUTPUT_FILE: 'sbom.cdx.json'
    ENRICH: true
    UPLOAD: false
```

**Other CI/CD environments** - We have ready-to-use templates for GitLab CI, Bitbucket Pipelines, and a Docker image for any environment.

[View all CI/CD integrations →](https://sbomify.com/features/integrations/)

All options handle generation + augmentation + enrichment automatically. The Docker image comes **bundled with all SBOM generation tools** - no need to install cdxgen, syft, or other tools separately.

### Step 4: Sign in CI/CD

**If an SBOM isn't signed at generation time, can you trust it?**

SBOMs generated outside CI/CD (or without signing) could be altered post-generation. No cryptographic proof means no way to verify authenticity or integrity.

![Diagram: trust chain](https://sbomify.com/assets/images/d2/trust-chain.svg)

```d2
CICD: {
  label: "CI/CD Pipeline"
  Generate: {
    label: "Generate"
  }
  Sign: {
    label: "Sign"
  }
  Generate -> Sign
}
Distribute: {
  label: "Distribute"
}
Verify: {
  label: "Verify"
}
CICD.Sign -> Distribute: "Signed SBOM"
Distribute -> Verify
Verify -> CICD: "Trust"
```

Signing in CI/CD creates an unbroken chain of trust from build to distribution:

- Customers receiving your SBOM can verify it hasn't been tampered with
- Reduces reliance on trusting the distribution platform
- Aligns with supply chain security best practices

The sbomify action supports attestation via GitHub Actions (Sigstore) and other signing mechanisms.

[Learn about SBOM attestation →](https://sbomify.com/2024/10/31/github-action-update-and-attestation/)

### Step 5: Understand the Full Lifecycle (Optional)

For those who want to understand what's happening under the hood:

![Diagram: generation](https://sbomify.com/assets/images/d2/generation.svg)

```d2
Generation
Augmentation
Enrichment
Signing: {
    stroke-dash: 3
  }
}
Generation -> Augmentation
Augmentation -> Enrichment
Enrichment -> Signing
```

The sbomify action automates the entire authoring flow: **Generation → Augmentation → Enrichment → Signing**

[SBOM Lifecycle Deep Dive →](https://sbomify.com/features/generate-collaborate-analyze/)

### Step 6: Manage and Share at Scale

When you're generating one SBOM, management is easy. When you have dozens or hundreds across multiple products, services, and release cycles, you need:

- **Logical grouping** - Organize SBOMs by product, team, or release
- **SBOM Hierarchy** - Link related SBOMs (e.g., backend + frontend + container = product SBOM)
- **Version tracking** - Keep historical SBOMs for audit trails
- **Automated distribution** - Share with customers/regulators without manual work

[Learn about SBOM Hierarchy →](https://sbomify.com/features/sbom-hierarchy/)

![Diagram: store analyze enrich](https://sbomify.com/assets/images/d2/store-analyze-enrich.svg)

```d2
CI: {
  label: "CI/CD Pipeline"
  Generate: {
    label: "Generate"
  }
  Enrich: {
    label: "Augment & Enrich"
  }
  Sign: {
    label: "Sign"
  }
  Generate -> Enrich
  Enrich -> Sign
}
sbomify
Analysis: {
  label: "Analysis"
}
CI.Sign -> sbomify: Upload
sbomify -> Analysis: Sync
```

### Trust Center: Turn Transparency into Competitive Advantage

The Trust Center is where "hero" status really shines. It's not just about generating SBOMs - it's about sharing them professionally with stakeholders.

- **Your domain** - Host on your own domain (e.g., trust.yourcompany.com)
- **Branded portal** - Your logo, your colors, professional presentation
- **Automated publishing** - Syncs with CI/CD, always up-to-date
- **Flexible access** - Public for transparency or private for invited stakeholders
- **More than SBOMs** - Share SOC 2, ISO 27001, pentest reports, compliance attestations in one place
- **Self-service** - Customers get what they need 24/7, no email chains

[Explore Trust Center →](https://sbomify.com/features/trust-center/)

---

## The Litmus Test

**SBOMs are becoming the litmus test for whether you actually know what goes into your software.**

Regulators and buyers are no longer asking "do you have security?" - they're asking "prove it." SBOMs are the proof.

### Already Required

- **EU Cyber Resilience Act (CRA)** - SBOMs mandatory for products with digital elements sold in EU
- **PCI DSS 4.0** - Software component inventories required for payment card security (Req 6.3.2)

### More Regulation is Coming

- FDA medical device guidance recommends SBOMs
- CISA minimum elements expanding requirements
- UK Software Security Code of Practice references software composition

**The message:** If you can't produce a quality SBOM on demand, you're signaling that you don't know what's in your software. That's increasingly a dealbreaker for enterprise buyers and regulators alike.

[SBOM Compliance Guide →](https://sbomify.com/compliance/) | [Why Now? →](https://sbomify.com/features/why-now/)

---

**Generate your first SBOM, then keep it monitored**
A free sbomify workspace stores the SBOM for every release, rescans it for new vulnerabilities and shares it with your customers.
[Start free](https://app.sbomify.com/)
Rolling it out across a product line? [Book a demo](https://app.sbomify.com/enterprise-contact/), or [explore our guides](https://sbomify.com/guides/).

---

From sbomify: https://sbomify.com/zero-to-hero/