bom – create, view and transform Software Bills of Materials

bom is a command-line multitool for creating and working with Software Bills of Materials.

It originated from the work needed to produce an SBOM for Kubernetes but is designed as a general-purpose utility rather than a Kubernetes-specific generator. The program works with SPDX documents and can construct an inventory from several different types of input, including ordinary files, whole directories and container images. Beyond generation, bom provides commands for inspecting and querying existing documents, making it useful at several stages of a software supply-chain workflow.

This is free and open source software.

Key Features

• Generates SPDX Software Bills of Materials.
• Accepts directories as SBOM input sources.
• Can describe individual files in a generated document.
• Scans container images for packages and other software information.
• Supports Docker image archives stored as tar files.
• Can pull container images from remote registries for analysis.
• Allows several source types to be combined into one document.
• Built-in classifier recognises more than 400 licences from the SPDX licence catalogue.
• Performs Go dependency analysis.
• Honours .gitignore rules when scanning Git repositories.
• Provides additional regular-expression based exclusions.
• Offers an offline mode for workflows that must avoid network access.
• Can export SBOM data as an in-toto provenance attestation.
• Displays the structural outline of an SPDX document.
• Provides queries for extracting information from existing SBOMs.
• Outputs documents in JSON or SPDX tag-value form.

Website: github.com/kubernetes-sigs/bom
Support:
Developer: Kubernetes SIGs
License: Apache License 2.0

bom is written in Go. Learn Go with our recommended free books and free tutorials.

Explore our carefully curated directory of recommended free and open source software, covering every major software category. The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form.