SBOM Tool – scalable Software Bill of Materials generator

SBOM Tool is a command-line utility for creating Software Bills of Materials from software build artifacts.

It is intended for scalable use in development and release pipelines, where an inventory of files, components and dependencies needs to accompany shipped software. The program scans both the material being distributed and the source or build-component directories used to produce it. Component discovery is delegated to Microsoft’s Component Detection libraries, while ClearlyDefined can supply additional licensing information. The resulting manifest can then be retained with an artifact or passed to other compliance and security processes.

This is free and open source software.

Key Features

• Generates Software Bills of Materials using the SPDX specification.
• Scans build-component directories for project and dependency information.
• Hashes files contained in the software distribution.
• Uses Microsoft Component Detection to identify software components.
• Can enrich component information with licensing data from ClearlyDefined.
• Validates existing SBOMs against the associated build output.
• Redacts file references from existing SBOM documents.
• Supports generating distinct namespaces for SBOM documents.
• Provides a command-line interface suitable for scripted operation.
• Offers an API for integration into .NET applications.
• Can be incorporated into GitHub Actions workflows.
• Supports integration with Azure DevOps pipelines.
• Available as a standalone executable for Linux.
• Can also be built and run as a container image.
• Telemetry is written locally rather than submitted to Microsoft.

Website: github.com/microsoft/sbom-tool
Support:
Developer: Microsoft
License: MIT License

SBOM Tool is written in C#. Learn C# with our recommended free books and free tutorials.

Explore our comprehensive directory of recommended free and open source software. Our carefully curated collection spans every major software category. This directory is part of our ongoing series of informative articles for Linux enthusiasts. It features hundreds of detailed reviews, along with open source alternatives to proprietary solutions from major corporations such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. You’ll also find interesting projects to try, hardware coverage, free programming books and tutorials, and much more. Discovered a useful open source Linux program that we haven’t covered yet? Let us know by completing this form.