awesome-sbom [](https://awesome.re)

December 17, 2025 · View on GitHub

A curated list of SBOM (Software Bill Of Materials) related tools, frameworks, blogs, podcasts, and articles

What is SBOM (Software Bill Of Materials) ?

From Wikipedia:

A software bill of materials (SBOM) is a list of components in a piece of software. Software vendors often create products by assembling open source and commercial software components. The SBOM describes the components in a product. It is analogous to a list of ingredients on food packaging: where you might consult a label to avoid foods that may cause an allergies, SBOMs can help companies avoid consumption of software that could harm their organization.

The concept of a BOM is well-established in traditional manufacturing as part of supply chain management. A manufacturer uses a BOM to track the parts it uses to create a product. If defects are later found in a specific part, the BOM makes it easy to locate affected products.

Contents

Official projects

Articles and Blogs

  • Wikipedia - Official Wikipedia Page
  • NTIA - Official National Telecommunications and Information Administration Page
  • What is an SBOM? - The Linux Foundation Article

Tools (and classification)

ToolBuild SBOMAnalyze SBOMEdit SBOMView SBOMDiff SBOMImport SBOMTranslate SBOMMerge SBOMIntegrate with Other Tools
AIsbomCycloneDX
AnthonyHarrison SBOM4PythonCycloneDX,SPDX
AnthonyHarrison SBOM4RustCycloneDX,SPDX
AnthonyHarrison SBOM4FilesCycloneDX,SPDX
AnthonyHarrison Distro2SBOMCycloneDX,SPDX
AnthonyHarrison SBOMDiffCycloneDX,SPDXCycloneDX,SPDX
AnthonyHarrison SBOM2docCycloneDX,SPDXCycloneDX,SPDX
AnthonyHarrison SBOM2dotCycloneDX,SPDXCycloneDX,SPDX
AnthonyHarrison SBOMAuditCycloneDX,SPDXCycloneDX,SPDX
AnthonyHarrison SBOM-ManagerCycloneDX,SPDXCycloneDX,SPDX
bomberCycloneDX,SPDXCycloneDX,SPDX
CycloneDX Maven PluginCycloneDX
CycloneDX CLI toolCycloneDXCycloneDXCycloneDX,SPDXCycloneDX
CycloneDX cdxgenCycloneDXCycloneDX
Interlynk SBOM AssemblerCycloneDX,SPDXCycloneDX,SPDXCycloneDX,SPDX
Interlynk SBOM Quality ScoreCycloneDX,SPDXCycloneDX,SPDXCycloneDX,SPDX
Interlynk SBOM GrepCycloneDX,SPDXCycloneDX,SPDXCycloneDX,SPDX
Interlynk SBOM Find & PullCycloneDX,SPDXCycloneDX,SPDX
Google osv-scannerCycloneDX,SPDX
Kubernetes SBOM ToolSPDX
Microsoft SBOM toolSPDX
OSS Review Toolkit ORTCycloneDX,SPDX
scm-rs sbom-cliCycloneDX,SPDXCycloneDX,SPDXCycloneDX,SPDX
SyftCycloneDX,SPDXCycloneDX,SPDXCycloneDX,SPDX
Snyk SBOM API & CLICycloneDX,SPDX
Snyk SBOM CheckerCycloneDX,SPDX
SBOM viewerCycloneDX,SPDX
SPDX Maven PluginSPDX
SPDX Gradle PluginSPDX
spdx-sbom-generatorSPDX
SwiftBOMCycloneDX,SPDX,SWID
TernCycloneDX,SPDX
TrivyCycloneDX,SPDXCycloneDX,SPDXCycloneDX,SPDX
DeepSCACycloneDXCycloneDXCyclondeDXCyclondeDXCyclondeDX
Meta Package ManagerCycloneDX,SPDX

Repositories

CycloneDX

SPDX

Community Repositories

Security Tools

  • AIsbom - CLI that scans AI models for malware and license risks and generates CycloneDX SBOMs.
  • bomber - bomber is an application that scans SBoMs for security vulnerabilities.
  • NTIA Conformance Checker - Check SPDX SBOM for NTIA minimum elements
  • sbom-scorecard - Generate a score for your sbom to understand if it will actually be useful.
  • parlay - Enrich SBOMs with data from third party services

Articles and Blogs

Videos

Slides

Podcasts

Benchmarks

  • SBOM Benchmark Quickly evaluate SBOM for quality, compliance and errors.