Awesome SBOM

This webpage provides an (hopefully) up-to-date overview of tools and software for creating, sharing, and managing Software Bill of Materials (SBOMs). SBOMs are essential for increasing transparency in the software supply chain, supporting both exposure management and compliance with evolving regulations.

The tools listed here cover the full SBOM lifecycle, from production and sharing to management and deployment, addressing key functional needs such as SBOM creation, validation, conversion, and vulnerability assessment. In addition, the overview highlights how these tools help meet important security goals, including authenticity, integrity, confidentiality, and availability.

Whether you are looking for open-source solutions or want to understand the current landscape of SBOM tooling, this site offers a practical starting point to select the right tools for your organization’s needs.

We are looking forward to contributions.

Learn about the SBOM lifecycle →

Tools

	Produce	Share		Manage				Deploy
Tool	Creation	Sharing	Ingestion	Quality assessment & validation	Conversion	Management	Enrichment	Vulnerability assessment
Chainloop
Cosign
CycloneDX CLI
CycloneDX Generator (cdxgen)
Dependency-Track
Grype
GUAC
SBOM Assembler
SBOM Explorer
SBOM Grep
SBOM Quality Score
SPDX Tools (Java/Python)
Syft
Transparency Exchange API
Witness

Full support Partial support

Chainloop

A repository for storing various types of artifacts. Because it supports signatures and attestations, it contributes to many security goals. Chainloop’s storage can be implemented using a Content Addressable Storage API, making data tamper-proof. It also offers integration with Dependency-Track and GUAC.

Link https://github.com/chainloop-dev/chainloop

Developer Chainloop (contributors include Google, OpenSSF, OWASP)

Release info March 2023 – July 2026 (v1.103.1)

Functional goals

Goal	Contribution
Signing	Full support Wraps artifacts in signed in-toto attestations using Sigstore or key-based signing
Ingestion	Full support Ingests SBOMs and other artifacts as attestation subjects in CI/CD workflows
Signature verification	Full support Verifies attestation signatures before releasing artifacts downstream
Management	Full support Provides a central control plane for managing attestations, policies, and artifact metadata across pipelines

Security goals

Goal	Contribution
Authenticity	Signature verification
Integrity	Signature verification
Non-repudiation	Attestation verification
Authorization	Role-based Access Control
Availability	Content Addressable Storage API

Cosign

With Cosign, it is possible to create and verify signatures for container images and other artifacts including SBOMs. It also has built-in support for in-toto attestations, enabling non-repudiation across the software supply chain.

Link https://github.com/sigstore/cosign

Developer Sigstore

Release info February 2021 – June 2026 (v3.1.1)

Functional goals

Goal	Contribution
Signing	Full support Signs any OCI artifact or file including SBOMs using keyless Sigstore signing or traditional key pairs
Signature verification	Full support Verifies signatures against the Sigstore transparency log or provided public keys

Security goals

Goal	Contribution
Authenticity	Signature creation and verification
Integrity	Signature creation and verification
Non-repudiation	Attestation creation and verification

CycloneDX CLI

A CLI tool to perform various operations on SBOMs in CycloneDX format. Compared to sbom-utility, it can create and verify signatures, but it does not have the capabilities to query SBOMs for vulnerabilities or components.

Link https://github.com/CycloneDX/cyclonedx-cli

Developer OWASP

Release info October 2022 – May 2026 (v0.32.0)

Functional goals

Goal	Contribution
Creation	Full support Merges multiple existing SBOMs into a new CycloneDX SBOM; does not generate SBOMs from source code
Signing	Full support Signs SBOMs using key pairs or Sigstore, producing detached signatures
Ingestion	Full support Reads CycloneDX SBOMs in JSON or XML for validation, merging, and conversion
Signature verification	Full support Verifies SBOM signatures using provided public keys or Sigstore
Quality assessment & validation	Full support Validates SBOMs against the CycloneDX schema specification
Conversion	Full support Converts between CycloneDX JSON and XML, and between CycloneDX and SPDX tag-value format

Security goals

Goal	Contribution
Authenticity	Signature creation and verification
Integrity	Signature creation and verification

CycloneDX Generator (cdxgen)

A CLI tool to generate BOMs with all project dependencies, accompanied by various functionalities. cdxgen supports a wide range of languages and package managers, making it one of the most versatile SBOM generation tools available.

Link https://github.com/CycloneDX/cdxgen

Developer OWASP

Release info June 2017 – July 2026 (v12.7.1)

Functional goals

Goal	Contribution
Creation	Full support Generates CycloneDX SBOMs from source code, container images, and package manifests across 20+ language ecosystems
Signing	Full support Signs SBOMs and attestations using Sigstore cosign
Ingestion	Full support Reads and processes existing CycloneDX SBOMs as input
Signature verification	Full support Verifies SBOM signatures and attestations via cosign
Quality assessment & validation	Full support Validates SBOMs against the CycloneDX schema and assesses component completeness
Conversion	Full support Converts between CycloneDX and SPDX formats
Management	Partial support Server mode provides a BOM API for serving and querying SBOMs, but lacks full lifecycle management

Security goals

Goal	Contribution
Authenticity	Signature creation and verification
Integrity	Signature creation and verification

Dependency-Track

An OWASP Flagship intelligent component analysis platform that leverages SBOMs to identify and reduce software supply chain risk. Dependency-Track ingests CycloneDX SBOMs and enriches them by integrating with multiple vulnerability intelligence sources (NVD, GitHub Advisories, OSV, Snyk, Trivy, and more). It tracks component usage across an entire application portfolio, enforces security and license policies, and exports SBOMs and VEX documents. Its API-first design makes it well suited for integration into CI/CD pipelines.

Link https://github.com/DependencyTrack/dependency-track

Developer OWASP

Release info March 2018 – June 2026 (5.0.2)

Functional goals

Goal	Contribution
Creation	Partial support Exports CycloneDX SBOMs and VEX documents for tracked projects; does not generate SBOMs from source code
Ingestion	Full support Ingests CycloneDX SBOMs via API or UI to populate the component portfolio
Sharing	Full support Exposes SBOMs and VEX via its REST API for downstream consumers and integrations
Quality assessment & validation	Partial support Enforces security, license, and operational policies; checks for outdated and modified components but not SBOM structural quality
Management	Full support Tracks component usage across all project versions in the portfolio with a full web UI and policy engine
Enrichment	Full support Integrates with NVD, GitHub Advisories, OSV, Snyk, Trivy, VulnDB and others to enrich components with vulnerability metadata
Vulnerability assessment	Full support Continuously matches components against multiple vulnerability databases and supports prioritisation via EPSS

Security goals

Goal	Contribution
Integrity	Detects modified components and tracks component usage across the portfolio to surface unexpected changes
Authorization	OAuth 2.0 + OpenID Connect (OIDC), Active Directory/LDAP, and API key support for fine-grained access control

Grype

Grype scans an environment for vulnerabilities based on input SBOMs. It integrates tightly with Syft and can accept SBOMs as input to perform vulnerability matching against a continuously updated database.

Link https://github.com/anchore/grype

Developer Anchore

Release info May 2020 – June 2026 (v0.115.0)

Functional goals

Goal	Contribution
Ingestion	Full support Reads CycloneDX and SPDX SBOMs as input for vulnerability scanning
Signature verification	Full support Verifies cosign signatures on container images before scanning
Vulnerability assessment	Full support Matches SBOM components against a continuously updated vulnerability database covering NVD, GitHub Advisories, and more

Security goals

Goal	Contribution
Authenticity	Signature verification
Integrity	Signature verification

GUAC

GUAC (Graph for Understanding Artifact Composition) is a tool designed to collect and analyze software artifacts. It builds a graph that clarifies the relationships between artifacts, making dependencies in the supply chain more transparent.

Link https://github.com/guacsec/guac

Developer Google, OpenSSF, OWASP

Release info June 2022 – March 2026 (v1.1.0)

Functional goals

Goal	Contribution
Ingestion	Full support Ingests SBOMs, SLSA provenance, Scorecard results, and other supply chain documents into a unified graph
Management	Partial support Stores and queries artifact relationships in a graph database; active development means some management features are still evolving
Vulnerability assessment	Partial support Queries the graph for vulnerability impact across the supply chain; relies on external scanners for initial vulnerability data

SBOM Assembler

One of Interlynk’s tools for working with SBOMs. SBOMs can be edited, searched, and merged, making it useful for managing and assembling SBOMs from multiple sources into a cohesive artifact.

Link https://github.com/interlynk-io/sbomasm

Developer Interlynk

Release info May 2023 – July 2026 (v2.0.9)

Functional goals

Goal	Contribution
Creation	Partial support Assembles a new SBOM by merging multiple existing SBOMs; does not generate SBOMs from source code
Ingestion	Full support Reads CycloneDX and SPDX SBOMs for merging, editing, and assembly operations
Management	Full support Edits, merges, and organises SBOMs from multiple sources into a single cohesive artifact

SBOM Explorer

A tool to search Interlynk’s public database of SBOMs. It allows users to explore and retrieve SBOMs for well-known open source components.

Link https://github.com/interlynk-io/sbomex

Developer Interlynk

Release info March 2023 – August 2024 (v0.1.0)

Functional goals

Goal	Contribution
Creation	Partial support Fetches SBOMs from the Interlynk public database and saves them locally
Ingestion	Partial support Searches and retrieves SBOMs from a public registry; read-only access to pre-existing SBOMs

SBOM Grep

SBOM Grep enables searching SBOMs based on various criteria such as package name, version, license, or other component properties.

Link https://github.com/interlynk-io/sbomgr

Developer Interlynk

Release info February 2023 – July 2025 (v1.0.1)

Functional goals

Goal	Contribution
Ingestion	Full support Reads CycloneDX and SPDX SBOMs to search components by name, version, license, or other properties

SBOM Quality Score

SBOM Quality Score compares SBOMs against their declared format specification and assigns a quality score. This score can then be published publicly, enabling consumers to assess the quality of an SBOM before relying on it.

Link https://github.com/interlynk-io/sbomqs

Developer Interlynk

Release info January 2023 – July 2026 (v2.0.11)

Functional goals

Goal	Contribution
Ingestion	Full support Reads CycloneDX and SPDX SBOMs to evaluate their content and completeness
Sharing	Partial support Can publish quality score results; primary output is a score report rather than SBOM redistribution
Quality assessment & validation	Full support Scores SBOMs against the declared format specification across multiple quality dimensions and produces a detailed report

SPDX Tools (Java/Python)

The two SPDX libraries for Java and Python offer the most functionalities for working with SPDX-format SBOMs, including creation and validation. It is important to note that they do not support conversion between CycloneDX and SPDX — conversion is limited to SPDX format variants.

Link https://github.com/spdx/tools-python

Developer SPDX

Release info January 2012 – March 2026 (v0.8.5)

Functional goals

Goal	Contribution
Creation	Full support Creates SPDX-format SBOMs programmatically via Python and Java library APIs
Ingestion	Full support Reads SPDX SBOMs in all standard serialisation formats (tag-value, JSON, RDF, YAML)
Quality assessment & validation	Full support Validates SPDX SBOMs against the SPDX specification for schema conformance and required fields
Conversion	Partial support Converts between SPDX serialisation variants (tag-value, JSON, RDF, YAML); does not convert to or from CycloneDX

Syft

A CLI tool for generating SBOMs for containers and filesystems. Syft integrates natively with Grype for vulnerability scanning — vulnerability assessment is considered partial as it requires Grype as a companion tool.

Link https://github.com/anchore/syft

Developer Anchore

Release info May 2020 – June 2026 (v1.46.0)

Functional goals

Goal	Contribution
Creation	Full support Generates SBOMs for containers and filesystems in CycloneDX and SPDX formats across many language ecosystems
Signing	Full support Signs SBOMs and container images using Sigstore cosign
Ingestion	Full support Reads existing SBOMs as input for conversion or re-processing
Signature verification	Full support Verifies cosign signatures on SBOMs and container images
Conversion	Full support Converts between CycloneDX and SPDX formats
Vulnerability assessment	Partial support Integrates natively with Grype for vulnerability scanning; assessment requires Grype as a companion tool

Security goals

Goal	Contribution
Authenticity	Signature creation and verification
Integrity	Signature creation and verification
Non-repudiation	Attestation creation and verification

Transparency Exchange API

This API aims to enable the exchange of BOMs and other artifacts across the software supply chain. The Ecma Technical Committee 54 is chartered to standardize this for OWASP CycloneDX: the BOM specification, standards, and algorithms.

Link https://github.com/CycloneDX/transparency-exchange-api/

Developer CycloneDX – Ecma TC 54

Release info June 2021 – February 2025

Functional goals

Goal	Contribution
Ingestion	Full support Provides a standardised API endpoint for uploading SBOMs and other transparency artifacts into the exchange
Sharing	Full support Serves SBOMs and other transparency documents to consumers via a standardised REST API

Security goals

Goal	Contribution
Authorization	Authenticated API

Witness

Witness uses in-toto attestations to track and verify what happened during the software build process. It supports signing and verifying signatures, making it a strong contributor to supply chain integrity and non-repudiation goals.

Link https://github.com/in-toto/witness

Developer In-Toto

Release info October 2021 – April 2026 (v0.11.0)

Functional goals

Goal	Contribution
Signing	Full support Signs in-toto attestations capturing build steps, materials, and products using Sigstore or key-based signing
Signature verification	Full support Verifies the full chain of in-toto attestations to confirm software was built as intended

Security goals

Goal	Contribution
Authenticity	Signature creation and verification
Integrity	Signature creation and verification
Non-repudiation	Attestation creation and verification