What is an SBOM?

The 30-second definition

An SBOM lists every direct and transitive dependency shipped inside an artifact — the name, version, supplier, license, and a package URL (PURL) that uniquely identifies it. Modern SBOMs also record how components relate (dependency edges), where they came from (provenance), and cryptographic hashes so downstream consumers can verify what they received.

Why they exist

After Log4Shell, most organizations couldn't answer a simple question: are we running the vulnerable library, and where? SBOMs make that answer a database lookup instead of an incident-response scramble. Regulators noticed:

• US EO 14028 requires SBOMs for software sold to the federal government.
• EU Cyber Resilience Act (CRA) makes SBOMs mandatory for products with digital elements from 2027.
• FDA requires them for premarket submissions of connected medical devices.
• NIST SSDF and NTIA minimum-elements guidance define what a "good" SBOM looks like.

The two formats you'll meet

Two open standards dominate: CycloneDX (OWASP) and SPDX (Linux Foundation, ISO 5962). Both cover the NTIA minimum elements. CycloneDX leans toward security use cases and adds VEX, ML-BOM, and CBOM extensions; SPDX has deeper license-compliance lineage. Most tools speak both — see our CycloneDX vs SPDX comparison for the field-by-field differences.

Generating one

You don't hand-write SBOMs — you generate them from your build. Common generators:

• syft — filesystem and container images
• cdxgen — polyglot, CycloneDX-native
• cargo-cyclonedx, npm sbom, mvn cyclonedx — language-native
• trivy sbom — scanner-produced

Using one (this is the part most teams skip)

Generating an SBOM is easy. Doing something with it is where value lives. A useful CI pipeline does four things on every build:

1. Diff against the last release to see what components changed.
2. Enrich with OSV and CISA KEV to flag known vulnerabilities.
3. Score completeness against NTIA / CRA so a weak SBOM fails review.
4. Gate the release on policy — no new criticals, no EOL runtimes, no typosquats.

That's what sbom-tools is built for — one Rust binary, no telemetry, drops into any CI in under a minute.