Software Bill of Materials (SBOM)

An ingredient list for software

A Software Bill of Materials is a machine-readable inventory of every component in a piece of software: name, version, supplier, package URL (purl), licence and often hashes. The two main formats are CycloneDX (from OWASP) and SPDX (from the Linux Foundation). Tools such as Syft, Trivy and cdxgen generate SBOMs from source directories or container images, ideally during the build so the SBOM matches exactly what shipped. Why bother when you already run SCA? Because an SBOM is a record. When a critical vulnerability in a popular library is announced months after release, teams with SBOMs for every deployed version can search them and answer in minutes which services are affected; teams without them grep through repositories and hope. SBOMs are also increasingly requested by customers and regulators, and they can be signed and attached to images as attestations.

Querying an SBOM when a CVE drops

A trimmed CycloneDX document and a lookup for an affected version range. Real SBOMs come from a tool like syft myapp:1.0 -o cyclonedx-json.

import json

sbom = json.loads('''{
  "bomFormat": "CycloneDX", "specVersion": "1.5",
  "components": [
    {"name": "requests", "version": "2.31.0", "purl": "pkg:pypi/requests@2.31.0"},
    {"name": "pyyaml",   "version": "5.3",    "purl": "pkg:pypi/pyyaml@5.3"},
    {"name": "flask",    "version": "3.0.3",  "purl": "pkg:pypi/flask@3.0.3"}
  ]}''')

def v(s): return tuple(int(p) for p in s.split("."))
advisory = {"name": "pyyaml", "fixed_in": "5.4"}  # affected: < 5.4
for c in sbom["components"]:
    if c["name"] == advisory["name"] and v(c["version"]) < v(advisory["fixed_in"]):
        print("AFFECTED:", c["purl"], "-> upgrade to", advisory["fixed_in"])
print(len(sbom["components"]), "components checked")

Output:

AFFECTED: pkg:pypi/pyyaml@5.3 -> upgrade to 5.4
3 components checked

Generate per build, store per release

An SBOM written by hand or generated once a year is stale. Produce it in the pipeline for every release artefact and store it next to the artefact, keyed by version or image digest.

त्वरित जाँच: What question does an SBOM help you answer quickly?

• Is our code formatted correctly?
• How many developers worked on this release?
• What is our cloud bill?
• Which of our deployed releases contain a newly disclosed vulnerable component?