SBOM Tool is a command-line utility for creating Software Bills of Materials from software build artifacts.
It is intended for scalable use in development and release pipelines, where an inventory of files, components and dependencies needs to accompany shipped software. The program scans both the material being distributed and the source or build-component directories used to produce it. Component discovery is delegated to Microsoft’s Component Detection libraries, while ClearlyDefined can supply additional licensing information. The resulting manifest can then be retained with an artifact or passed to other compliance and security processes.
This is free and open source software.
Key Features
- Generates Software Bills of Materials using the SPDX specification.
- Scans build-component directories for project and dependency information.
- Hashes files contained in the software distribution.
- Uses Microsoft Component Detection to identify software components.
- Can enrich component information with licensing data from ClearlyDefined.
- Validates existing SBOMs against the associated build output.
- Redacts file references from existing SBOM documents.
- Supports generating distinct namespaces for SBOM documents.
- Provides a command-line interface suitable for scripted operation.
- Offers an API for integration into .NET applications.
- Can be incorporated into GitHub Actions workflows.
- Supports integration with Azure DevOps pipelines.
- Available as a standalone executable for Linux.
- Can also be built and run as a container image.
- Telemetry is written locally rather than submitted to Microsoft.
Website: github.com/microsoft/sbom-tool
Support:
Developer: Microsoft
License: MIT License
SBOM Tool is written in C#. Learn C# with our recommended free books and free tutorials.
Related Software
| Software Bills of Materials | |
|---|---|
| Syft | Catalog packages and dependencies in images and filesystems |
| ScanCode Toolkit | Detect licences, copyrights and package metadata in source code |
| ORT | Automate dependency analysis, licence compliance and policy checks |
| SBOM Tool | Create SPDX-compatible component inventories at scale |
| Trivy | Scan containers and filesystems for vulnerabilities and licence issues |
| bom | Create, inspect, transform and validate SPDX manifests |
| CycloneDX CLI | Analyse, merge, convert, sign and validate CycloneDX documents |
| sbomnix | Analyse Nix packages for dependencies, licences and vulnerabilities |
Read our verdict in the software roundup.
 Explore our carefully curated directory of recommended free and open source software, covering every major software category.The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form. |
Please read our Comment Policy before commenting.