SBOM: the bill of materials for your software.

What it is really for

The legal obligation came later. The practical reasons were already there.

• Answering in minutes rather than days when a vulnerability lands on a widely used library.
• Knowing which open source licences you inherited, before the customer’s legal team finds out.
• Answering vendor questionnaires without rebuilding everything by hand each time.
• Meeting what the Cyber Resilience Act requires, which names it explicitly.

What it contains

Components and versions

Every library with its exact version. Without precise versions an SBOM does not answer the question it exists for.

Identifiers

PURL or CPE — names a machine can match against vulnerability databases. That is what makes the list usable.

Licences

The declared licence of each component: the least technical and most treacherous side of the supply chain.

Relationships

Who depends on what. It separates a direct dependency you control from a transitive one you inherited.

Provenance

Who generated it, when, and from which build. An SBOM without context goes stale unnoticed.

CycloneDX or SPDX

Two standard formats, both accepted. The choice matters less than people fear.

• CycloneDX comes from the security world and pairs most directly with vulnerability data.
• SPDX comes from the licensing world and has a longer tradition on the legal side.
• Converters exist between them: the choice is not a door that closes.
• What matters far more is that the SBOM is generated on every build rather than written once by hand.

How to produce one

The single rule that matters: generated by the build, not compiled by hand.

1. Generate the SBOM as part of the pipeline, like any other release artefact.
2. Take dependencies from the project’s package manager, not from a list kept on the side: the second always drifts.
3. Include transitive dependencies: they are most of the components and most of the vulnerabilities.
4. Store it alongside the released version: you need to say what was inside a two-year-old release, not only today’s.
5. Match it regularly against vulnerability databases, otherwise it is a snapshot that warns you of nothing.

Three wrong beliefs