SBOM Authoritative-Source Library

A living reference to the standards, formats, and regulations that govern software bills of materials — each entry tracked with its status, legal force, and the date we last verified it.

Standards Catalog

Every authoritative SBOM standard, format, and regulation — searchable, with status, legal force, and last-verified date.

Generate an SBOM

Copy-paste commands to produce a standards-compliant SBOM for your stack — using ephemeral runners that add nothing to your project.

Verified as of 2026-06

npm
Detected from: package-lock.json (v2/v3)
```
npx -y @cyclonedx/cyclonedx-npm --output-format JSON --output-file sbom/bom.cdx.json
```
Emits: CycloneDX (reads the lockfile; adds nothing to the project)
Zero-install: a vendored lockfile reader can also emit CycloneDX 1.6 + SPDX 2.3 with no dependencies.
View source
pnpm / yarn
Detected from: pnpm-lock.yaml / yarn.lock
```
syft dir:. -o cyclonedx-json=sbom/bom.cdx.json -o spdx-json=sbom/bom.spdx.json
```
Emits: CycloneDX + SPDX
cyclonedx-npm can't read pnpm/yarn lockfiles — use Syft.
View source
Python
Detected from: requirements.txt / poetry.lock
```
pipx run cyclonedx-bom -o sbom/bom.cdx.json
```
Emits: CycloneDX
View source

Go

Detected from: go.mod + go.sum

go run github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest mod -json -output sbom/bom.cdx.json

Emits: CycloneDX

View source

Rust
Detected from: Cargo.lock
```
cargo install --locked cargo-cyclonedx && cargo cyclonedx -f json
```
Emits: CycloneDX
Caps at spec 1.5 (defaults 1.3); normalize with `syft convert` if a consumer needs 1.6.
View source
Java (Maven)
Detected from: pom.xml
```
mvn org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom
```
Emits: CycloneDX (plugin run; not added to pom)
View source
.NET
Detected from: .csproj / .sln
```
dotnet CycloneDX <project-or-sln> --json --output sbom/
```
Emits: CycloneDX
Needs `dotnet restore` to resolve the transitive closure.
View source
container / polyglot
Detected from: image ref or mixed repo
```
syft <image>@<digest> -o cyclonedx-json=sbom/bom.cdx.json   # or: cdxgen -o sbom/bom.cdx.json
```
Emits: CycloneDX + SPDX (Syft) — also converts between formats
View source

Format Comparison

CycloneDX vs SPDX vs SWID, and the NTIA minimum fields every SBOM should carry.

Verified as of 2026-06

Format	Owner	Current version	Standard	Best for	BOM types
CycloneDX	OWASP	1.7 (Oct 2025)	ECMA-424 (2nd ed., Dec 2025)	Security-oriented use; native VEX/VDR; broad xBOM coverage.	SBOM, SaaSBOM, HBOM, ML-BOM, CBOM, OBOM, MBOM, VEX, VDR, CDXA
SPDX	Linux Foundation	3.0.1 (Dec 2024)	ISO/IEC 5962:2021 (codifies SPDX 2.2.1, not 3.x)	Licensing/compliance lineage; ISO recognition. Default to 2.3 for consumer compatibility.	Software, Security, AI, Dataset, Build, Licensing profiles (3.x)
SWID Tags	ISO/IEC	ISO/IEC 19770-2:2015	ISO/IEC 19770-2	Software identification/asset management. Removed from CISA 2025 draft's recognized SBOM formats.	—

NTIA minimum fields (the baseline both formats satisfy)

Supplier
Component Name
Version
Other Unique Identifiers (purl/CPE)
Dependency Relationship
Author of SBOM Data
Timestamp

What Your Regulator Requires

Who you are → what SBOM you owe: format, depth, disclosure, and deadline.

Verified as of 2026-06

If you are…
Mandatory
Manufacturers selling products with digital elements to the EU
EU Cyber Resilience Act (Reg. (EU) 2024/2847)
Format & depth
Commonly-used, machine-readable; at least top-level dependencies (Annex I Part II(1)).
Public?
Not required to be public — kept in technical documentation; provided to market-surveillance authorities on request.
Deadline
Reporting 11 Sep 2026; full application 11 Dec 2027.
View source
If you are…
Discretionary
US federal software suppliers
OMB M-26-05 (rescinded M-22-18/M-23-16)
Format & depth
No government-wide mandate; agencies may request an SBOM as a contractual term.
Public?
N/A — agency-discretionary.
Deadline
In effect since 23 Jan 2026 (the prior mandate was withdrawn).
View source
If you are…
Mandatory
Medical-device manufacturers (US premarket)
FD&C Act Section 524B
Format & depth
SBOM required in premarket submissions under §524B(b)(3); FDA final premarket cybersecurity guidance (27 Jun 2025).
Public?
Submitted to FDA; device-purchaser disclosure recommended by guidance.
Deadline
In force (refuse-to-accept authority since 1 Oct 2023).
View source
If you are…
Conditional
Suppliers to German federal systems
BSI TR-03183 Part 2 (v2.1.0)
Format & depth
CycloneDX ≥1.6 or SPDX ≥3.0.1; recursive (transitive) dependency resolution; Build SBOM.
Public?
Per procurement context.
Deadline
Current (v2.1.0, Aug 2025).
View source

Beyond Generation: Score, Scan, VEX, Sign

An SBOM is the start. Score its quality, scan it for vulnerabilities, suppress false positives with VEX, and sign it for provenance.

Score quality

Score SBOM quality with sbomqs; gate a build on a score of ≥ 7.0.

docker run --rm -v "$(pwd)":/app ghcr.io/interlynk-io/sbomqs:latest score /app/sbom/bom.cdx.json

Scan for vulnerabilities

Scan the SBOM for known vulnerabilities with Grype or OSV-Scanner.

grype sbom:sbom/bom.cdx.json   # or: osv-scanner --sbom=sbom/bom.cdx.json

VEX (suppress false positives)

A VEX document tells consumers which vulnerabilities actually affect your product, so they can suppress false positives. Example OpenVEX statement:

{"@context":"https://openvex.dev/ns/v0.2.0","@id":"https://example.com/vex-0001","author":"your-org","timestamp":"2026-06-18T00:00:00Z","version":1,"statements":[{"vulnerability":{"name":"CVE-2023-12345"},"products":[{"@id":"pkg:npm/lodash@4.17.21"}],"status":"not_affected","justification":"vulnerable_code_not_in_execute_path"}]}

Sign for provenance

Sign the SBOM as an attestation with cosign (v3) for provenance.

cosign attest-blob --predicate sbom/bom.cdx.json --type cyclonedx sbom/bom.cdx.json

The Free Generator

A zero-dependency generator that reads your lockfile and emits CycloneDX 1.6 + SPDX 2.3. Free to download and use.

Download — generate-sbom.mjs

Zero dependencies — reads your package-lock.json and emits CycloneDX 1.6 + SPDX 2.3. Never run npm install to make an SBOM.

Usage

node generate-sbom.mjs

node generate-sbom.mjs --format cyclonedx

node generate-sbom.mjs --format spdx

node generate-sbom.mjs --out-dir build/sbom

SBOM_TIMESTAMP=2026-01-01T00:00:00Z node generate-sbom.mjs

Authoritative external resources

Where this reference links out — the canonical free SBOM resources we build on rather than duplicate.

SBOM Authoritative-Source Library

Standards Catalog

Generate an SBOM

npm

pnpm / yarn

Python

Go

Rust

Java (Maven)

.NET

container / polyglot

Format Comparison

NTIA minimum fields (the baseline both formats satisfy)

What Your Regulator Requires

EU Cyber Resilience Act (Reg. (EU) 2024/2847)

OMB M-26-05 (rescinded M-22-18/M-23-16)

FD&C Act Section 524B

BSI TR-03183 Part 2 (v2.1.0)

Beyond Generation: Score, Scan, VEX, Sign

Score quality

Scan for vulnerabilities

VEX (suppress false positives)

Sign for provenance

The Free Generator

Authoritative external resources

SBOM Authoritative-Source Library

Standards Catalog

The Minimum Elements For a Software Bill of Materials (SBOM)

2025 Minimum Elements for a Software Bill of Materials (SBOM)

Software Bill of Materials (SBOM) for Artificial Intelligence — Minimum Elements

SPDX Specification 3.0.1

ISO/IEC 5962:2021 (SPDX 2.2.1)

CycloneDX (ECMA-424)

SWID Tags (ISO/IEC 19770-2)

Minimum Requirements for Vulnerability Exploitability eXchange (VEX)

OpenVEX Specification

Common Security Advisory Framework (CSAF) v2.0

Cyber Resilience Act — Regulation (EU) 2024/2847

Executive Order 14028 — Improving the Nation's Cybersecurity

Executive Order 14144 — Strengthening and Promoting Innovation in the Nation's Cybersecurity

Executive Order 14306 — Sustaining Select Efforts to Strengthen the Nation's Cybersecurity

US federal SBOM requirement (post-M-26-05)

OMB M-22-18 (software self-attestation mandate)

OMB M-26-05 — Risk-based Approach to Software and Hardware Security

FD&C Act Section 524B (medical-device cybersecurity)

NIST SP 800-218 — Secure Software Development Framework (SSDF) v1.1

NIST SP 800-218A — SSDF Community Profile for Generative AI

BSI TR-03183 Part 2 — Software Bill of Materials (SBOM)

Generate an SBOM

npm

pnpm / yarn

Python

Go

Rust

Java (Maven)

.NET

container / polyglot

Format Comparison

NTIA minimum fields (the baseline both formats satisfy)

What Your Regulator Requires

EU Cyber Resilience Act (Reg. (EU) 2024/2847)

OMB M-26-05 (rescinded M-22-18/M-23-16)

FD&C Act Section 524B

BSI TR-03183 Part 2 (v2.1.0)

Beyond Generation: Score, Scan, VEX, Sign

Score quality

Scan for vulnerabilities

VEX (suppress false positives)

Sign for provenance

The Free Generator

Authoritative external resources

The Minimum Elements For a Software Bill of Materials (SBOM)

2025 Minimum Elements for a Software Bill of Materials (SBOM)

Software Bill of Materials (SBOM) for Artificial Intelligence — Minimum Elements

SPDX Specification 3.0.1

ISO/IEC 5962:2021 (SPDX 2.2.1)

CycloneDX (ECMA-424)

SWID Tags (ISO/IEC 19770-2)

Minimum Requirements for Vulnerability Exploitability eXchange (VEX)

OpenVEX Specification