Modern software is rarely built in isolation. Applications often depend on hundreds of libraries, frameworks and other components, making it difficult to know exactly what is included in a software package.
These tools create detailed inventories of those components and their dependencies. This information can help identify vulnerable packages, track licences, improve supply-chain security and simplify compliance work.
They are particularly useful for developers, security teams, package maintainers and organisations that need a clear picture of the software they build, distribute or deploy.
Here’s our verdict captured in a legendary LinuxLinks-style ratings chart. Only free and open source software is eligible for inclusion here.
Click the links in the table below to learn more about each application.
| Software Bills of Materials | |
|---|---|
| Syft | Catalog packages and dependencies in images and filesystems |
| ScanCode Toolkit | Detect licences, copyrights and package metadata in source code |
| ORT | Automate dependency analysis, licence compliance and policy checks |
| SBOM Tool | Create SPDX-compatible component inventories at scale |
| Trivy | Scan containers and filesystems for vulnerabilities and licence issues |
| bom | Create, inspect, transform and validate SPDX manifests |
| CycloneDX CLI | Analyse, merge, convert, sign and validate CycloneDX documents |
| sbomnix | Analyse Nix packages for dependencies, licences and vulnerabilities |
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.